PATENT ABSTRACT
In a functional encryption scheme where a decryption key dk can decrypt a ciphertext encrypted by an encryption key ek, when decrypting the encryption key in which a parameter Φ is set, by the decryption key dk in which a parameter Ψ is set, if and only if a relation R(Φ, Ψ) holds, a wider range as a relation R is expressed. Of first information including a polynomial d(x), plural polynomials D i (x), and predicate information, and second information including attribute information, a cryptographic system treats one as a ciphertext and a remaining one as a decryption key. A decryption device, based on the predicate information and attribute information, selects at least one of polynomials D i (x), and calculates a coefficient Δ i  enabling a polynomial constituted based on a polynomial Δ i D i (x) to be divided out by a polynomial d(x), the polynomial Δ i D i (x) obtained by multiplying the selected polynomial D i (x) by coefficient Δ i .

PATENT DESCRIPTION
TECHNICAL FIELD 
     The present invention to a functional encryption scheme which utilizes the notion of quadratic span program. 
     BACKGROUND ART 
     The functional encryption scheme is an encryption scheme that provides more sophisticated and flexible relations between an encryption key ek and a decryption key dk. 
     According to the functional encryption scheme, a parameter Φ and a parameter Ψ are respectively set in the encryption key ek and the decryption key dk. The decryption key dk can decrypt a ciphertext encrypted by the encryption key ek if and only if a relation R(Φ, Ψ) holds. 
     Non-Patent Literature 3 describes the functional encryption scheme. 
     Non-Patent Literature 6 describes the quadratic span program. 
     CITATION LIST 
     Non-Patent Literature 
     Non-Patent Literature 1: Okamoto, T, Takashima, K.: Homomorphic encryption and signatures from vector decomposition. in: Galbraith, S.D., Paterson, K.G. (eds.) Pairing 2008. LNCS, vol. 5209, pp. 57-74, Springer Heidelberg (2008) 
     Non-Patent Literature 2: Okamoto, T., Takashima, K.: Hierarchical predicate encryption for inner-products, In: ASIACRYPT 2009, Springer Heidelberg (2009) 
     Non-Patent Literature 3: Okamoto, T., Takashima, K.: Fully secure functional encryption with general relations from the decisional linear assumption. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 191-208. Springer Heidelberg (2010). Full version is available at the Cryptology ePrint Archive website 
     Non-Patent Literature 4: Okamoto, T., Takashima, K.: Efficient attribute-based signatures for non-monotone predicates in the standard model, in: PKC 2011, Springer Heidelberg (2011) 
     Non-Patent Literature 5: Okamoto, T., Takashima, K.:Decentralized Attribute-Based Signatures the Cryptology ePrint Archive website 
     Non-Patent Literature 6: Rosario Gennaro and Craig Gentry and Bryan Parno and Mariana R.aykova: Quadratic Span Programs and Succinct NIZKs without PCPs the Cryptology ePrint Archive website 
     SUMMARY OF INVENTION 
     Technical Problem 
     The functional encryption scheme described in Non-Patent Literature 3 is a scheme that utilizes linear span program. This functional encryption scheme can express only a limited range as a relation R. 
     It is an object of the present invention to provide a functional encryption scheme which, by utilizing the notion of quadratic span program, can express a wider range as the relation R. 
     Solution to Problem 
     A cryptographic system according to the present invention includes: 
     an encryption device which generates one of first information including a quadratic span program and second information including attribute information, as a ciphertext; and 
     a decryption device which, treating a remaining one of the first information and the second information, as a decryption key, if the quadratic span program accepts the attribute information, decrypts the ciphertext based on information obtained from the quadratic span program and the attribute information. 
     Advantageous Effects of Invention 
     The cryptographic system according to the present invention utilizes the notion of the quadratic span program, so that an ideal range can be expressed as the relation R. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is an explanatory drawing of a quadratic span program. 
         FIG. 2  is an explanatory drawing of a subset I u . 
         FIG. 3  is a configuration diagram of a cryptographic system  10  which executes a KP-FE scheme. 
         FIG. 4  is a configuration diagram of a cryptographic system  10  which executes a CP-FE scheme. 
         FIG. 5  is a configuration diagram of a key generation device  100  according to Embodiment 2. 
         FIG. 6  is a configuration diagram of an encryption device  200  according to Embodiment 2. 
         FIG. 7  is a configuration diagram of a decryption device  300  according to Embodiment 2. 
         FIG. 8  is a flowchart showing the process of Setup algorithm according to Embodiment 2. 
         FIG. 9  is a flowchart showing the process of KeyGen algorithm according to Embodiment 2. 
         FIG. 10  is a flowchart showing the process of Enc algorithm according to Embodiment 2. 
         FIG. 11  is a flowchart showing the process of Dec algorithm according to Embodiment 2. 
         FIG. 12  is a flowchart showing the process of KeyGen algorithm according to Embodiment 4. 
         FIG. 13  is a diagram showing an example of the hardware configuration of the key generation device  100 , the encryption device  200 , and the decryption device  300 . 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     Embodiments of the present invention will be described hereinafter with reference to the accompanying drawings. 
     In the following description, a processing device is a CPU  911  (to be described later) and the like. A storage device is a ROM  913 , a RAM  914 , a magnetic disk  920  (each will be described later), and the like. A communication device is a communication board  915  (to be described later) and the like. An input device is a keyboard  902 , the communication board  915  (each will be described later), and the like. Namely, the processing device, the storage device, the communication device, and the input device are hardware. 
     The notation in the following description will be explained. 
     When A is a random variable or distribution, Formula 101 denotes that y is randomly selected from A according to the distribution of A. Namely, in Formula 101, y is a random number. 
     
       
         
           
             
               
                 
                   y 
                   ⁢ 
                   
                     ← 
                     R 
                   
                   ⁢ 
                   A 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     101 
                   
                   ] 
                 
               
             
           
         
       
     
     When A is a set, Formula 102 denotes that y is uniformly selected from A. Namely, in Formula 102, y is a uniform random number. 
     
       
         
           
             
               
                 
                   y 
                   ⁢ 
                   
                     ← 
                     U 
                   
                   ⁢ 
                   A 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     102 
                   
                   ] 
                 
               
             
           
         
       
     
     Formula 103 denotes that y is a set, defined or substituted by z.
 
y:=z  [Formula 103]
 
     When a is a fixed value, Formula 104 denotes an event that a machine (algorithm) A outputs a on input x.
 
 A ( x )→ a   [Formula 104]
 
     For example,
 
 A ( x )→1
 
     Formula 105, namely, F q , denotes a finite field of order q.
 
             q   [Formula 105]

     A vector symbol denotes a vector representation over the finite field F q . Namely, Formula 106 is established.
 
{right arrow over (x)} denotes
 
(x 1 , . . . ,x n )ε             q   n   [Formula 106]

     Formula 107 denotes the inner-product, indicated by Formula 109, of two vectors x →  and v →  indicated in Formula 108.
 
{right arrow over (x)}·{right arrow over (v)}  [Formula 107]
 
{right arrow over ( x )}=( x   1   , . . . ,x   n ),
 
{right arrow over ( v )}=( v   1   , . . . ,v   n )  [Formula 108]
 
Σ i=1   n x i v i   [Formula 109]
 
     Note that X T  denotes the transpose of matrix M. 
     When b i  (i=1, . . . , n) is an element of a vector in a space V, namely, when Formula 110 is established, Formula 111 denotes the subspace generated by Formula 112.
 
 b   i ε           ( i= 1, . . . , n )  [Formula 110]
 
span         b 1 , . . . ,b n             ⊂           (resp. span         {right arrow over (x)} 1 , . . . ,{right arrow over (x)} n           )  [Formula 111]
 
b 1 , . . . ,b n (resp. {right arrow over (x)} 1 , . . . ,{right arrow over (x)} n )  [Formula 112]

     Note that for bases B and B* indicated in Formula 113, Formula 114 is established.
 
           :=( b   1   , . . . ,b   N ),
 
         *:=( b   1   *, . . . ,b*   N )  [Formula 113]
 
( x   1   , . . . ,x   N )         :=Σ i=1   N   x   i   b   i ,
 
( y   1   , . . . ,y   N )         *:=Σ i=1   N   y   i   b*   i   [Formula 114]

     In the following description, when “Vt” is indicated as a subscript or superscript, Vt is V t . Likewise, when “δi,j” is indicated as a superscript, δi,j is δ i,j . Likewise, when “fτ” and “κτ” are indicated as superscripts, fτ is f τ , and κτ is κ τ . 
     When “→” indicating a vector is attached to a subscript or superscript, “→” is attached as a superscript to the subscript or superscript. 
     In the following description, a cryptographic process includes a key generation process, an encryption process, and a decryption process. 
     Embodiment 1. 
     This embodiment describes a basic concept of the functional encryption scheme that utilizes the quadratic span program, and the outline of the functional encryption scheme that utilizes the quadratic span program. 
     First, a space having a rich mathematical structure called “dual pairing vector spaces (DPVS)” which is a space for implementing the functional encryption scheme will be described. 
     Second, a concept for implementing the functional encryption scheme will be described. Here, “quadratic span program”, “equalities of attribute information, and quadratic span program”, and “secret distribution scheme” will be described. 
     Third, the outline of the functional encryption scheme that utilizes the quadratic span program will be described. 
     &lt;2. Dual Pairing Vector Spaces&gt; 
     First, symmetric bilinear pairing groups will be described. The symmetric bilinear pairing groups (q, G, G T , g, e) are a tuple of a prime q, a cyclic additive group G of order q, a cyclic multiplicative group G T  of order q, g≠0εG, and a polynomial-time computable nondegenerate bilinear pairing e:G×G→G T . The nondegenerate bilinear pairing signifies e(sg, tg)=e(g, g) st  where e(g, g)≠1. 
     In the following description, let G bpg  be an algorithm that takes as input 1 λ  and outputs the value of a parameter param G :=(q, G, G T , g, e) of bilinear pairing groups with a security parameter λ. 
     Dual pairing vector spaces will now be described. 
     The dual pairing vector spaces (q, V, G T , A, e) can be constituted by a direct product of symmetric bilinear pairing groups (param G :=(q, G, G T , g, e)). The dual pairing vector spaces (q, V, G T , A, e) are a tuple of a prime q, an N-dimensional vector space V over F q  indicated in Formula 115, a cyclic group G T  of the order q, and a canonical basis A:=(a 1 , . . . , a N ) of a space V, and have the following operations (1) and (2) where a i  is as indicated by Formula 116. 
     
       
         
           
             
               
                 
                   := 
                   
                     
                       × 
                       … 
                       ⁢ 
                       
                           
                       
                       × 
                     
                     
                       ︷ 
                       N 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     115 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     a 
                     i 
                   
                   := 
                   
                     ( 
                     
                       
                         
                           0 
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           0 
                         
                         
                           ︷ 
                           
                             i 
                             - 
                             1 
                           
                         
                       
                       , 
                       g 
                       , 
                       
                         
                           0 
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           0 
                         
                         
                           ︷ 
                           
                             N 
                             - 
                             i 
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     116 
                   
                   ] 
                 
               
             
           
         
       
     
     Operation (1): Nondegenerate Bilinear Pairing 
     The pairing on the space V is defined by Formula 117.
 
 e ( x,y ):=Π i=1   N   e ( G   i   ,H   i )ε             T   [Formula 117]
 
where
 
( G   1   , . . . ,G   N ):= xε             ,  
 
( H   1   , . . . ,H   N ):= yε               

     This is nondegenerate bilinear, i.e., e(sx, ty)=e(s, y) st  and if e(x, y)=1 for all yεV then x=0. For all i and j, e(a i , a j )=e(g, g) δi,j  where δ i,j =1 if i=j, and δ i,j =0 if i≠j. Also, e(g, g)≠1εG T . 
     Operation (2): Distortion Maps 
     Linear transformation φ i,j  on the space V indicated in Formula 118 can achieve Formula 119. 
     
       
         
           
             
               
                 
                   
                     
                       ϕ 
                       
                         i 
                         , 
                         j 
                       
                     
                     ⁡ 
                     
                       ( 
                       
                         a 
                         j 
                       
                       ) 
                     
                   
                   = 
                   
                     
                       
                         
                           a 
                           i 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         k 
                       
                       ≠ 
                       
                         j 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         then 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ϕ 
                             
                               i 
                               , 
                               j 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               a 
                               k 
                             
                             ) 
                           
                         
                       
                     
                     = 
                     0 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     118 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         ϕ 
                         
                           i 
                           , 
                           j 
                         
                       
                       ⁡ 
                       
                         ( 
                         x 
                         ) 
                       
                     
                     := 
                     
                       ( 
                       
                         
                           
                             0 
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             0 
                           
                           
                             ︷ 
                             
                               i 
                               - 
                               1 
                             
                           
                         
                         , 
                         
                           g 
                           j 
                         
                         , 
                         
                           
                             0 
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             0 
                           
                           
                             ︷ 
                             
                               N 
                               - 
                               i 
                             
                           
                         
                       
                       ) 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       Note 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           
                             g 
                             1 
                           
                           , 
                           
                             … 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               g 
                               N 
                             
                           
                         
                         ) 
                       
                     
                     := 
                     x 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     119 
                   
                   ] 
                 
               
             
           
         
       
     
     Linear transformation φ i,j  will be called distortion maps. 
     In the following description, let G dpvs  be an algorithm that takes as input, 1 λ  (λε natural number), Nεnatural number, and the values of the parameter param G :=(q, G, G T , g, e) of bilinear pairing groups, and outputs the value of a parameter param v :=(q, V, G T , A, e) of dual pairing vector spaces which have a security parameter λ and which form an N-dimensional space V. 
     A case will be described where dual pairing vector spaces are constructed from the symmetric bilinear pairing groups described above. Dual pairing vector spaces can be constructed from asymmetric bilinear pairing groups as well. The following description can be easily applied to a case where dual pairing vector spaces are constructed from asymmetric bilinear pairing groups. 
     &lt;2. Concept for Implementing Functional Encryption&gt; 
     &lt;2-1. Quadratic Span Program&gt; 
       FIG. 1  is an explanatory drawing of a quadratic span program. 
     The quadratic span program over the field F q  includes two polynomial sets, i.e., a set A={a i (x)|iε{0, . . . , L}} and a set B={b i (x)|iε{0, . . . , L}}, and a target polynomial d(x). The quadratic span program includes a label ρ of a set I:={1, . . . , L}. All labels ρ i (i=1, . . . , L) are each related to one literal of {p 0 , p 1 , . . . , p n ,            p 1 , . . . ,          p n }, namely, ρ:I→{p 0 , p 1 , . . . , p n ,          p 1 , . . . ,          p n }.
     For an input u:=(u 1 , . . . , u n )ε{0, 1} n , a true value T of the literal is set from T(p j ):=u j  and T(           p j ):=         u j  concerning each integer j of j=1, . . . , n. For any input u, 1 is set as the true value T of p o . Namely, T(p 0 ):=1.
     A subset I u  of the set I is constructed from the elements of a label for which 1 is set upon input u. Namely, I u :={iεI|T(p(i)=1)}. Alternatively, I u :={iεI|[ρ(i)=p j             u j =1]         [ρ(i)=         p j           u j =0]         [ρ(i)=p 0 ]}.
       FIG. 2  is an explanatory drawing of the subset I u . 
     Note that in  FIG. 2 , n=7 and L=6. Also, in  FIG. 2 , assume that the labels ρ are related such that ρ 1  corresponds to            p 2 , ρ 2  to p 1 , ρ 3  to p 4 , ρ 4  to          p 5 , ρ 5  to          p 3 , and ρ 6  to p 5 .
     Regarding input u:=(u 1 , . . . , u 7 )ε{0, 1} 7 , assume that u 1 =1, u 2 =0, u 3 =1, u 4 =0, u 5 =0, u 6 =1, and u 7 =1. In this case, the subset I u  consists of elements i of labels ρ i  related to literals (p 1 , p 3 , p 6 , p 7 ,            p 2 ,          p 4 ,          p 5 ) surrounded by broken lines. That is, the subset I u  consists of the elements i of labels ρ 1 , ρ 2 , and ρ 4 , thus the subset I u :={i=1, 2, 4}.
     The quadratic span program accepts input uε{1, 0} n  (or accepts the subset I u ) if and only if a tuple of (α 1 , . . . , α L ) and (β 1 , . . . , β L ) exists where α i =0=β i  concerning every i not included in the subset I u , the tuple of (α 1 , . . . , α L ) and (β 1 , . . . , β L ) being a tuple over a field F q   L  in which the target polynomial d(x) divides out Formula 120. Otherwise, the quadratic span program rejects input uε{1, 0} n . 
     
       
         
           
             
               
                 
                   
                     ( 
                     
                       
                         
                           a 
                           0 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             i 
                             = 
                             1 
                           
                           L 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           · 
                           
                             
                               a 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                     
                     ) 
                   
                   · 
                   
                     ( 
                     
                       
                         
                           b 
                           0 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             i 
                             = 
                             1 
                           
                           L 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             β 
                             i 
                           
                           · 
                           
                             
                               b 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     120 
                   
                   ] 
                 
               
             
           
         
       
     
     That is, the quadratic span program accepts input uε{1, 0} n  if and only if a tuple of α i  and β i  exists concerning iεI u  in which the target polynomial d(x) divides out Formula 121. 
     
       
         
           
             
               
                 
                   
                     ( 
                     
                       
                         
                           a 
                           0 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             i 
                             ∈ 
                             ℐ 
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           · 
                           
                             
                               a 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                     
                     ) 
                   
                   · 
                   
                     ( 
                     
                       
                         
                           b 
                           0 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             i 
                             ⁢ 
                             
                                 
                             
                             ∈ 
                             ℐ 
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             β 
                             i 
                           
                           · 
                           
                             
                               b 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     121 
                   
                   ] 
                 
               
             
           
         
       
     
     If the quadratic span program accepts input uε{1, 0} n , the tuple of α i  and β i  concerning iεI u  is polynomial-time computable (see Non-Patent Literature 6). 
     With the example shown in  FIG. 2 , the quadratic span program accepts input uε{1, 0} n  if and only if a tuple of α i  and β i  exists concerning iεI u :={i=1, 2, 4} in which the target polynomial d(x) divides out Formula 121. 
     
       
         
           
             
               
                 
                   
                     ( 
                     
                       
                         
                           a 
                           0 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             i 
                             ∈ 
                             
                               { 
                               
                                 1 
                                 , 
                                 2 
                                 , 
                                 4 
                               
                               } 
                             
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           · 
                           
                             
                               a 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                     
                     ) 
                   
                   · 
                   
                     ( 
                     
                       
                         
                           b 
                           0 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             i 
                             ⁢ 
                             
                                 
                             
                             ∈ 
                             
                               { 
                               
                                 1 
                                 , 
                                 2 
                                 , 
                                 4 
                               
                               } 
                             
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             β 
                             i 
                           
                           · 
                           
                             
                               b 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     122 
                   
                   ] 
                 
               
             
           
         
       
     
     &lt;2-2. Inner-Product of Attributes and Quadratic Span Program&gt; 
     U t  (t=1, . . . , d and U t ⊂{0, 1}*) is a sub-universe and an attribute set. Each U t  includes identification information (t) of the sub-universe and attribute information (v → ) expressed as an n-dimensional vector. Namely, U t  is (t, v → )) where tε{1, . . . , d} and v → εF q   n . 
     Let U t :=(t, v → ) be p, that is, p:=(t, v → ). An explanation will be given on a method of determining the subset L in a quadratic span program Q:=(A, B, d(x), ρ) by p j :=(t, v →   j )(j=1, . . . , n; tε{1, . . . , d}). 
     Let an access structure S be a quadratic span program Q:=(A, B, d(x), ρ) accompanying p 0  and {p i :=(t, v →   j )} j=1, . . . , n . That is, ρ:{1, . . . , L}→{p 0 , (t, v →   1 ), . . . , (t, v →   n ),            (t, v →   1 ), . . . ,          (t, v →   n )}. Let Γ be an attribute set, that is, Γ:={(t, x →   t )|x →   t εF q   n , 1≦t≦d}. Note that t is a subset of {1, . . . , d} and need not be all indexes.
     When an attribute set Γ is given to the access structure S, a true value T of the literals {p 0 , p 1 , . . . , p n ,            p 1 , . . . ,          p n } is determined as follows. T(p j ):=1 if and only if p j =(t, v →   j ) and (t, v →   t )εΓ and v →   j ·x →   t ε0. T(         p j )):=1 if and only if p j =         (t, v →   j ) and (t, x →   j )εΓ and v →   j ·x →   t ≠0. T(p 0 ):=1. Otherwise, the true value T is 0.
     Also, I u  (=I (ρ,Γ) :={iεI|T(ρ(i))=1}, that is, I (ρ,Γ) :={iεI|[ρ(i)=(t, v →   j )           (t, x →   t )εΓ         (v →   j ·x →   t )=0]         [(ρ(i)=         (t, v →   j )         (t, v →   j )εΓ         v →   j ·x →   t ≠0]         [ρ(i)=p 0 ]}.
     &lt;3. Outline of Functional Encryption Scheme&gt; 
     A functional encryption scheme is constituted by letting one of a decryption key and a ciphertext have the access structure S described above and the other one have the attribute set Γ. 
     A functional encryption scheme in which a decryption key has an access structure S is called Key-Policy functional encryption (KP-FE) scheme, and an encryption scheme in which a ciphertext has an access structure S is called Ciphertext-Policy functional encryption (CP-FE) scheme. 
     The structures of the KP-FE scheme and CP-FE scheme and the structures of cryptographic systems  10  that execute the respective schemes will be described. 
     &lt;3-1. KP-FE Scheme&gt; 
     The KP-FE scheme consists of four algorithms: Setup, KeyGen, Enc, and Dec. 
     (Setup) 
     The Setup algorithm is a randomized algorithm that takes as input a security parameter λ and outputs public parameters pk and a master key sk. 
     (KeyGen) 
     The KeyGen algorithm is a randomized algorithm that takes as input an access structure S, the public parameters pk, and the master key sk, and outputs a decryption key sk S . 
     (Enc) 
     The Enc algorithm is a randomized algorithm that takes as input a message msg, an attribute set Γ:={(t, x →   t )|x →   t εF q   n , 1≦t≦d}, and the public parameters pk, and outputs a ciphertext ct Γ . 
     (Dec) 
     The Dec algorithm is an algorithm that takes as input the ciphertext ct Γ  encrypted under the attribute set Γ, the decryption key sk S  for the access structure S, and the public parameters pk, and outputs either the message msg or distinguished symbol ⊥. 
       FIG. 3  is a configuration diagram of a cryptographic system  10  that executes the KP-FE scheme. 
     The cryptographic system  10  is provided with a key generation device  100 , an encryption device  200 , and a decryption device  300 . 
     The key generation device  100  executes the Setup algorithm by taking as input a security parameter λ, and generates public parameters pk and a master key sk. The key generation device  100  publicizes the generated public parameters pk. The key generation device  100  also executes the KeyGen algorithm by taking as input an access structure S, generates a decryption key sk S , and distributes the decryption key sk S  to the decryption device  300  in secrecy. 
     The encryption device  200  executes the Enc algorithm by taking as input a message msg, an attribute set Γ, and the public parameters pk, and generates a ciphertext ct Γ . The encryption device  200  transmits the generated ciphertext ct Γ  to the decryption device  300 . 
     The decryption device  300  executes the Dec algorithm by taking as input the public parameters pk, the decryption key sk S , and the ciphertext ct Γ , and outputs a message msg or distinguished symbol ⊥. 
     &lt;3-2. CP-FE Scheme&gt; 
     The CP-FE scheme consists of four algorithms: Setup, KeyGen, Enc, and Dec. 
     (Setup) 
     The Setup algorithm is a randomized algorithm that takes as input a security parameter λ and outputs public parameters pk and a master key sk. 
     (KeyGen) 
     The KeyGen algorithm is a randomized algorithm that takes as input an attribute set Γ:={(t, x →   t )|x →   t εF q   n , 1≦t≦d}, the public parameters pk, and the master key sk, and outputs a decryption key sk S . 
     (Enc) 
     The Enc algorithm is a randomized algorithm that takes as input a message msg, an access structure S, and the public parameters pk, and outputs a ciphertext ct S . 
     (Dec) 
     The Dec algorithm is an algorithm that takes as input the ciphertext ct S  encrypted under the access structure S, a decryption key sk Γ  for the attribute set Γ, and the public parameters pk, and outputs a message msg or distinguished symbol ⊥. 
       FIG. 4  is a configuration diagram of a cryptographic processing system  10  that executes the CP-FE scheme. 
     The cryptographic processing system  10  is provided with a key generation device  100 , an encryption device  200 , and a decryption device  300 . 
     The key generation device  100  executes the Setup algorithm by taking as input a security parameter λ and generates public parameters pk and a master key sk. The key generation device  100  publicizes the generated public parameters pk. The key generation device  100  also executes the KeyGen algorithm by taking as input an attribute set Γ, generates a decryption key sk Γ , and distributes the decryption key sk Γ  to the decryption device  300  in secrecy. 
     The encryption device  200  executes the Enc algorithm by taking as input a message msg, an access structure S, and the public parameters pk, and generates a ciphertext ct S . The encryption device  200  transmits the generated ciphertext ct S  to the decryption device  300 . 
     The decryption device  300  executes the Dec algorithm by taking as input the public parameters pk, the decryption key sk Γ , and the ciphertext ct S , and outputs a message msg or distinguished symbol ⊥. 
     In both the KP-FE scheme and the CP-FE scheme, with the Dec algorithm, based on the access structure S and the attribute set Γ, a subset I (ρ,Γ)  is selected by the method described above, and furthermore a coefficient (α 1 , . . . , α L ) and a coefficient (β 1 , . . . , β L ) are specified. Based on the subset I (ρ,Γ) , the coefficient (α 1 , . . . , α L ), and the coefficient (β 1 , . . . , β L ), the ciphertext ct Γ  (or ct s ) is decrypted and the message msg is calculated. 
     Normally, the Setup algorithm is executed only once at the setup of the system. The KeyGen algorithm is executed each time the user decryption key is to be generated. The Enc algorithm is executed each time the message msg is to be encrypted. The Dec algorithm is executed each time the ciphertext is to be decrypted. 
     In the cryptographic system  10  according to Embodiment 1, the functional encryption scheme is constituted using the access structure S which is based on the quadratic span program. As a result, an ideal range can be expressed as a relation R. 
     Embodiment 2 
     In Embodiment 2, an explanation will be given on a configuration example of a functional encryption scheme that utilizes a quadratic span program. 
     The KP-FE scheme is the example to be explained. 
       FIG. 5  is a configuration diagram of a key generation device  100  according to Embodiment 2.  FIG. 6  is a configuration diagram of an encryption device  200  according to Embodiment 2.  FIG. 7  is a configuration diagram of a decryption device  300  according to Embodiment 2. 
       FIGS. 8 and 9  are flowcharts showing the operation of the key generation device  100 , in which  FIG. 8  is a flowchart showing the process of the Setup algorithm, and  FIG. 9  is a flowchart showing the process of the KeyGen algorithm.  FIG. 10  is a flowchart showing the operation of the encryption device  200 , being the process of the Enc algorithm.  FIG. 11  is a flowchart showing the operation of the decryption device  300 , being the process of the Dec algorithm. 
     The function and operation of the key generation device  100  will be described. 
     The key generation device  100  is provided with a master key generation part  110 , a master key storage part  120 , an information input part  130 , a decryption key generation part  140 , and a key distribution part  150 . The decryption key generation part  140  is provided with a secret information generation part  141  and a key element generation part  142 . 
     The process of the Setup algorithm will be described with reference to  FIG. 8 . 
     (S 101 : Orthogonal Basis Generation Step) 
     With the processing device, the master key generation part  110  calculates Formula 123, to generate parameters param, bases B 0  and B* 0 , and base s B t  and B* t . 
     
       
         
           
             
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     123 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   input 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     1 
                     λ 
                   
                 
               
               
                 
                   ( 
                   1 
                   ) 
                 
               
             
             
               
                 
                   
                     param 
                     ?? 
                   
                   := 
                   
                     
                       ( 
                       
                         q 
                         , 
                         ?? 
                         , 
                         
                           ?? 
                           T 
                         
                         , 
                         g 
                         , 
                         e 
                       
                       ) 
                     
                     ⁢ 
                     
                       ⟵ 
                       R 
                     
                     ⁢ 
                     
                       
                         ?? 
                         bpg 
                       
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                   
                 
               
               
                 
                   ( 
                   2 
                   ) 
                 
               
             
             
               
                 
                   ψ 
                   ⁢ 
                   
                     ⟵ 
                     U 
                   
                   ⁢ 
                   
                     ?? 
                     q 
                     x 
                   
                 
               
               
                 
                   ( 
                   3 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       n 
                       0 
                     
                     := 
                     
                       
                         2 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           mf 
                           max 
                         
                       
                       + 
                       1 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       n 
                       t 
                     
                     := 
                     
                       
                         2 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           mf 
                           max 
                         
                         ⁢ 
                         
                           k 
                           max 
                         
                       
                       + 
                       
                         n 
                         ⁡ 
                         
                           ( 
                           
                             
                               t 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             d 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       N 
                       0 
                     
                     := 
                     
                       
                         n 
                         0 
                       
                       + 
                       
                         u 
                         0 
                       
                       + 
                       
                         w 
                         0 
                       
                       + 
                       
                         z 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       N 
                       t 
                     
                     := 
                     
                       
                         n 
                         t 
                       
                       + 
                       
                         u 
                         t 
                       
                       + 
                       
                         w 
                         t 
                       
                       + 
                       
                         
                           z 
                           t 
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               t 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             d 
                           
                           ) 
                         
                       
                     
                   
                 
               
               
                 
                   ( 
                   4 
                   ) 
                 
               
             
           
         
       
     
     Processes of (5) to (9) are executed concerning each t of t=0, . . . , d. 
     
       
         
           
             
               
                 
                   
                     param 
                     
                       ?? 
                       t 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         q 
                         , 
                         
                           ?? 
                           t 
                         
                         , 
                         
                           ?? 
                           T 
                         
                         , 
                         
                           ?? 
                           t 
                         
                         , 
                         e 
                       
                       ) 
                     
                     := 
                     
                       
                         ?? 
                         dpvs 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             1 
                             λ 
                           
                           , 
                           
                             N 
                             t 
                           
                           , 
                           
                             param 
                             ?? 
                           
                         
                         ) 
                       
                     
                   
                 
               
               
                 
                   ( 
                   5 
                   ) 
                 
               
             
             
               
                 
                   
                     X 
                     t 
                   
                   := 
                   
                     
                       
                         ( 
                         
                           χ 
                           
                             t 
                             , 
                             i 
                             , 
                             j 
                           
                         
                         ) 
                       
                       
                         i 
                         , 
                         
                           j 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           N 
                           t 
                         
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       GL 
                       ⁡ 
                       
                         ( 
                         
                           
                             N 
                             t 
                           
                           , 
                           
                             q 
                           
                         
                         ) 
                       
                     
                   
                 
               
               
                 
                   ( 
                   6 
                   ) 
                 
               
             
             
               
                 
                   
                     X 
                     t 
                     * 
                   
                   := 
                   
                     
                       
                         ( 
                         
                           ϑ 
                           
                             t 
                             , 
                             i 
                             , 
                             j 
                           
                         
                         ) 
                       
                       
                         i 
                         , 
                         
                           j 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           N 
                           t 
                         
                       
                     
                     := 
                     
                       ψ 
                       · 
                       
                         
                           ( 
                           
                             X 
                             t 
                             T 
                           
                           ) 
                         
                         
                           - 
                           1 
                         
                       
                     
                   
                 
               
               
                 
                   ( 
                   7 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       b 
                       
                         t 
                         , 
                         i 
                       
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               χ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           t 
                         
                       
                       = 
                       
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               1 
                             
                             
                               N 
                               t 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               χ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                               a 
                               
                                 t 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                         
                         = 
                         1 
                       
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     N 
                     t 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ?? 
                       t 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             t 
                             , 
                             1 
                           
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             t 
                             , 
                             
                               N 
                               t 
                             
                           
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   ( 
                   8 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       b 
                       
                         t 
                         , 
                         i 
                       
                       * 
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               ϑ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           t 
                         
                       
                       = 
                       
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               1 
                             
                             
                               N 
                               t 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               ϑ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                               a 
                               
                                 t 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                         
                         = 
                         1 
                       
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     N 
                     t 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ?? 
                       t 
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             t 
                             , 
                             1 
                           
                           * 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             t 
                             , 
                             
                               N 
                               t 
                             
                           
                           * 
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   ( 
                   9 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       g 
                       T 
                     
                     := 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             g 
                             , 
                             g 
                           
                           ) 
                         
                       
                       ⁢ 
                       ψ 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     param 
                     := 
                     
                       ( 
                       
                         
                           
                             { 
                             
                               param 
                               
                                 ?? 
                                 t 
                               
                             
                             } 
                           
                           
                             
                               t 
                               = 
                               0 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             d 
                           
                         
                         , 
                         gT 
                       
                       ) 
                     
                   
                 
               
               
                 
                   ( 
                   10 
                   ) 
                 
               
             
           
         
       
     
     Namely, the master key generation part  110  executes the following processes. 
     (1) With the input device, the master key generation part  110  takes as input the security parameter λ(1 λ ). 
     (2) With the processing device, the master key generation part  110  executes the algorithm G bpg  by taking as input the security parameter λ inputted in (1), and generates the value of parameters param G :=(q, G, G T , g, e) of bilinear pairing groups. 
     (3) With the processing device, the master key generation part  110  generates a random number ψ. 
     (4) The master key generation part  110  sets n 0 +n 0 +w 0 +z 0  in N 0 , and sets n t +u t +w t +z t  in N t  concerning each integer t of t=1, . . . , d (d is an integer of 1 or more). Note that n 0  is 2mf max +1 and n t  is 2mf max k max +n where: m is the number of factors obtained by factorizing the target polynomial d(x); f in . is the maximum value (maximum value of f τ  to be described later) of the degrees of the factors obtained by factorizing the target polynomial d(x); k max  is the maximum value of the number of labels ρ related to one piece of identification information t; n is an integer of 1 or more; and u 0 , w 0 , z 0 , u t , w t , and z t  are each an integer of 0 or more. 
     Subsequently, the master key generation part  110  executes the following processes (5) to (9) concerning each integer t of t=0, . . . , d. 
     (5) With the processing device, the master key generation part  110  executes algorithm G dpvs  by taking as input the security parameter λ inputted in (1), N t  set in (4), and the values of param G :=(q, G, G T , g, e) generated in (2), and generates the values of parameters param Vt :=(q, V t , G T , A t , e) of the dual pairing vector spaces. 
     (6) With the processing device, the master key generation part  110  takes as input N t  set in (4), and F q , and generates linear transformation X t :=(χ t,i,j ) i,j  randomly. Note that GL stands for General Linear. Namely, GL is a general linear group, a set of square matrices in which the determinant is not 0, and a group with respect to multiplication. Note that (χ t,i,j ) i,j  signifies a matrix concerning suffixes i and j of a matrix χ t,i,j  where i, j=1, . . . , N t . 
     (7) With the processing device and based on the random number ψ and the linear transformation X t , the master key generation part  110  generates X* t :=(ν t,i,j ) i,j :=ψ·(X t   T ) −1 . As (χ t,i,j ) i,j  does, (ν t,i,j ) i,j  signifies a matrix concerning suffixes i and j of a matrix ν t,i,j  where i, j=1, . . . , N t . 
     (8) With the processing device and based on the linear transformation X t  generated in (6), the master key generation part  110  generates a basis B t  from a canonical basis A t  generated in (5). Note that x →   t,i  indicates the i-th row of the linear transformation X t . 
     (9) With the processing device and based on the linear transformation X* t  generated in (7), the master key generation part  110  generates a basis B* t  from the canonical basis A t  generated in (5). Note that v →   t,i  indicates the i-th row of the linear transformation X* t . 
     (10) With the processing device, the master key generation part  110  sets e(g, g) ψ  in g T . The master key generation part  110  also sets g t  and {param Vt } t=0, . . . , d  generated in (5), in param. 
     In brief, in (S 101 ), the master key generation part  110  executes algorithm G ob  indicated in Formula 124, and generates param, the bases B 0  and B* 0 , and the bases B t  and B* t . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           ?? 
                           ob 
                         
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           param 
                           ?? 
                         
                         := 
                         
                           
                             ( 
                             
                               q 
                               , 
                               ?? 
                               , 
                               
                                 ?? 
                                 T 
                               
                               , 
                               g 
                               , 
                               e 
                             
                             ) 
                           
                           ⁢ 
                           
                             ⟵ 
                             R 
                           
                           ⁢ 
                           
                             
                               ?? 
                               bpg 
                             
                             ⁡ 
                             
                               ( 
                               
                                 1 
                                 λ 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         ψ 
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           x 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           n 
                           0 
                         
                         := 
                         
                           
                             2 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               mf 
                               max 
                             
                           
                           + 
                           1 
                         
                       
                       , 
                       
                         
                           n 
                           t 
                         
                         := 
                         
                           
                             2 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               mf 
                               max 
                             
                             ⁢ 
                             
                               k 
                               max 
                             
                           
                           + 
                           
                             n 
                             ⁢ 
                             
                               ( 
                               
                                 
                                   t 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           N 
                           0 
                         
                         := 
                         
                           
                             n 
                             0 
                           
                           + 
                           
                             u 
                             0 
                           
                           + 
                           
                             w 
                             0 
                           
                           + 
                           
                             z 
                             0 
                           
                         
                       
                       , 
                       
                         
                           N 
                           t 
                         
                         := 
                         
                           
                             n 
                             t 
                           
                           + 
                           
                             u 
                             t 
                           
                           + 
                           
                             w 
                             t 
                           
                           + 
                           
                             
                               z 
                               t 
                             
                             ⁢ 
                             
                               ( 
                               
                                 
                                   t 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           param 
                           
                             ?? 
                             t 
                           
                         
                         := 
                         
                           
                             ( 
                             
                               q 
                               , 
                               
                                 ?? 
                                 t 
                               
                               , 
                               
                                 ?? 
                                 T 
                               
                               , 
                               
                                 ?? 
                                 t 
                               
                               , 
                               e 
                             
                             ) 
                           
                           := 
                           
                             
                               ?? 
                               dpvs 
                             
                             ⁡ 
                             
                               ( 
                               
                                 
                                   1 
                                   λ 
                                 
                                 , 
                                 
                                   N 
                                   t 
                                 
                                 , 
                                 
                                   param 
                                   ?? 
                                 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           X 
                           t 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 χ 
                                 
                                   t 
                                   , 
                                   i 
                                   , 
                                   j 
                                 
                               
                               ) 
                             
                             
                               i 
                               , 
                               
                                 j 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 N 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             GL 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   N 
                                   t 
                                 
                                 , 
                                 
                                   ?? 
                                   q 
                                 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           X 
                           t 
                           * 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 ϑ 
                                 
                                   t 
                                   , 
                                   i 
                                   , 
                                   j 
                                 
                               
                               ) 
                             
                             
                               i 
                               , 
                               
                                 j 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 N 
                                 t 
                               
                             
                           
                           := 
                           
                             ψ 
                             · 
                             
                               
                                 ( 
                                 
                                   X 
                                   t 
                                   T 
                                 
                                 ) 
                               
                               
                                 - 
                                 1 
                               
                             
                           
                         
                       
                       , 
                       hereafter 
                       , 
                       
                         
                           χ 
                           → 
                         
                         
                           t 
                           , 
                           i 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           and 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               ϑ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           denote 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           the 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           i 
                           ⁢ 
                           
                             - 
                           
                           ⁢ 
                           th 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           rows 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           of 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             X 
                             t 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           and 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             X 
                             t 
                             * 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           i 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                       respectively 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           b 
                           
                             t 
                             , 
                             i 
                           
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   χ 
                                   → 
                                 
                                 
                                   t 
                                   , 
                                   i 
                                 
                               
                               ) 
                             
                             ⁢ 
                             
                               ?? 
                               t 
                             
                           
                           = 
                           
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   1 
                                 
                                 
                                   N 
                                   t 
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   χ 
                                   
                                     t 
                                     , 
                                     i 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   a 
                                   
                                     t 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 for 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 i 
                               
                             
                             = 
                             1 
                           
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ?? 
                           t 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   N 
                                   t 
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           b 
                           
                             t 
                             , 
                             i 
                           
                           * 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   ϑ 
                                   → 
                                 
                                 
                                   t 
                                   , 
                                   i 
                                 
                               
                               ) 
                             
                             ⁢ 
                             
                               ?? 
                               t 
                             
                           
                           = 
                           
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   1 
                                 
                                 
                                   N 
                                   t 
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   ϑ 
                                   
                                     t 
                                     , 
                                     i 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   a 
                                   
                                     t 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 for 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 i 
                               
                             
                             = 
                             1 
                           
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ?? 
                           t 
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   N 
                                   t 
                                 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           g 
                           T 
                         
                         := 
                         
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 g 
                                 , 
                                 g 
                               
                               ) 
                             
                           
                           ⁢ 
                           ψ 
                         
                       
                       , 
                       
                         param 
                         := 
                         
                           ( 
                           
                             
                               
                                 { 
                                 
                                   param 
                                   
                                     ?? 
                                     t 
                                   
                                 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   0 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                             
                             , 
                             gT 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ( 
                             
                               param 
                               , 
                               
                                 ?? 
                                 t 
                               
                               , 
                               
                                 ?? 
                                 t 
                                 * 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     124 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 102 : Public Parameter Generation Step) 
     With the processing device, the master key generation part  110  generates subbases B^ 0  and B^ t  of the bases B 0  and B t , respectively, which are generated in (S 101 ), as indicated in Formula 125.
 
             0 =( b   0,1   ,b   0,n     0     +u     0     +w     0     +1   , . . . ,b   0,n     0     +u     0     +w     0     +z     0   ),
 
           t :=( b   t,1   , . . . ,b   t,n   ,b   t,n     t     +u     t     +w     t     +1   , . . . ,b   t,n     t     +u     t     +w     t     +z     t   ) for  t= 1, . . . , d   [Formula 125]

     The master key generation part  110  treats the generated subbases B^ 0  and B^ A   t , the security parameter λ inputted in (S 101 ), and param generated in (S 101 ), to form the public parameters pk. 
     (S 103 : Master Key Generation Step) 
     With the processing device, the master key generation part  110  generates subbases B^* 0  and B^* t  of the bases B* 0  and basis B* 6  respectively, which are generated in (S 101 ), as indicated in Formula 126.
 
           * 0 :=( b*   0,1   , . . . ,b*   0,n     0     ,b*   0,n     0     +u     0     +1   ,b*   0,n     0     +u     0     +w     0     ,b*   0n     0     +u     0     +w     0     +z     0   ),
 
         * t :=( b*   t,1   , . . . ,b*   t,n     t     ,b*   t,n     t     +u     t     +1   , . . . ,b*   t,n     t     +u     t     +w     t   ) for  t= 1, . . . , d   [Formula 126]

     The master key generation part  110  treats the generated subbases B^* 0  and B^* t , to form the master key sk. 
     (S 104 : Master Key Storing Step) 
     The master key storage part  120  stores the public parameters pk generated in (S 102 ), in the storage device. The master key storage part  120  also stores the master key sk generated in (S 103 ), in the storage device. 
     In brief, from (S 101 ) through (S 103 ), the key generation device  100  generates the public parameters pk and the master key sk by executing the Setup algorithm indicated in Formula 127. Then, in (S 104 ), the key generation device  100  stores the generated public parameters pk and master key sk, in the storage device. 
     Note that the public parameters are publicized via, e.g., a network, so the encryption device  200  and decryption device  300  can acquire them. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Setup 
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ( 
                         
                           param 
                           , 
                           
                             
                               ( 
                               
                                 
                                   ?? 
                                   t 
                                 
                                 , 
                                 
                                   ?? 
                                   t 
                                   * 
                                 
                               
                               ) 
                             
                             
                               
                                 t 
                                 = 
                                 0 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ⟵ 
                         R 
                       
                       ⁢ 
                       
                         
                           ?? 
                           ob 
                         
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           t 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 n 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                   + 
                                   
                                     z 
                                     t 
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   n 
                                   0 
                                 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           t 
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   n 
                                   t 
                                 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   1 
                                 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                 
                               
                               * 
                             
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           pk 
                         
                         := 
                         
                           ( 
                           
                             
                               1 
                               λ 
                             
                             , 
                             
                               
                                 { 
                                 
                                   
                                     ?? 
                                     ^ 
                                   
                                   t 
                                 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   0 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                             
                             , 
                             param 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         := 
                         
                           
                             
                               { 
                               
                                 
                                   ?? 
                                   ^ 
                                 
                                 t 
                                 * 
                               
                               } 
                             
                             
                               
                                 t 
                                 = 
                                 0 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     127 
                   
                   ] 
                 
               
             
           
         
       
     
     The process of the KeyGen algorithm will be described with reference to  FIG. 9 . 
     (S 201 : Information Input Step) 
     With the input device, the information input part  130  takes as input the access structure S:=(A, B, d(x), ρ) described above. Note that the attribute information of the user of the decryption key sk S  is set in ρ. The target polynomial d(x) included in the access structure S can be factorized into m of factors d τ (x) fτ  where τ=1, . . . , m, as indicated in Formula 128. 
     
       
         
           
             
               
                 
                   
                     d 
                     ⁡ 
                     
                       ( 
                       x 
                       ) 
                     
                   
                   = 
                   
                     
                       ∏ 
                       
                         τ 
                         = 
                         1 
                       
                       m 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           d 
                           τ 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       
                         f 
                         τ 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     128 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 202 : Secret Information it Generation Step) 
     With the processing device, the secret information generation part  141  generates secret information π τ,κ,0  and secret information π τ,κ,1 , as indicated in Formula 129. 
     
       
         
           
             
               
                 
                   
                     
                       π 
                       τ 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       π 
                       m 
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           π 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     129 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 203 : Secret Information χ Generation Step) 
     With the processing device, the secret information generation part  141  generates secret information χ τ,κ,0  and secret information χ τ,κ,1  as indicated in Formula 130. 
     
       
         
           
             
               
                 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     130 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 204 : Secret Information s Generation Step) 
     With the processing device, the secret information generation part  141  generates secret information s 0   (τ,κ,0)  and secret information s 0   (τ,κ,1) , and secret information s i   (τ,κ,0)  and secret information s i   (τ,κ,1) , as indicated in Formula 131. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           τ 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       m 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ι 
                         = 
                         0 
                       
                       , 
                       1 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         := 
                         
                           deg 
                           ⁡ 
                           
                             ( 
                             
                               
                                 
                                   d 
                                   τ 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                               κ 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         := 
                         
                           deg 
                           ⁡ 
                           
                             ( 
                             
                               
                                 
                                   d 
                                   τ 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 f 
                                 τ 
                                 
                                   - 
                                   κ 
                                 
                               
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           
                             κ 
                             = 
                             0 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             f 
                             τ 
                           
                         
                         ) 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             a 
                             
                               i 
                               , 
                               0 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                           + 
                           
                             
                               a 
                               
                                 i 
                                 , 
                                 1 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                 
                                 ) 
                               
                             
                             ⁢ 
                             x 
                           
                           + 
                           … 
                           + 
                           
                             
                               a 
                               
                                 i 
                                 , 
                                 
                                   
                                     μ 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                   - 
                                   1 
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               x 
                               
                                 
                                   μ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                                 - 
                                 1 
                               
                             
                           
                         
                         := 
                         
                           
                             
                               a 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           ⁢ 
                           mod 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             κ 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             b 
                             
                               i 
                               , 
                               0 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                           + 
                           
                             
                               b 
                               
                                 i 
                                 , 
                                 1 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                 
                                 ) 
                               
                             
                             ⁢ 
                             x 
                           
                           + 
                           … 
                           + 
                           
                             
                               b 
                               
                                 i 
                                 , 
                                 
                                   
                                     μ 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                   - 
                                   1 
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               x 
                               
                                 
                                   μ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                                 - 
                                 1 
                               
                             
                           
                         
                         := 
                         
                           
                             
                               b 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           ⁢ 
                           mod 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           ⁢ 
                           
                             f 
                             τ 
                             
                               - 
                               κ 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           
                             ?? 
                             q 
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 j 
                                 = 
                                 0 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   μ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 - 
                                 1 
                               
                             
                             ) 
                           
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           s 
                           0 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         := 
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               0 
                             
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               δ 
                               j 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             · 
                             
                               a 
                               
                                 0 
                                 , 
                                 j 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                 
                                 ) 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           0 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         := 
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               0 
                             
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               δ 
                               j 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             · 
                             
                               b 
                               
                                 0 
                                 , 
                                 j 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                 
                                 ) 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           i 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           ξ 
                           
                             i 
                             , 
                             τ 
                             , 
                             ι 
                           
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           
                             ?? 
                             q 
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   τ 
                                   = 
                                   1 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   m 
                                   - 
                                   1 
                                 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ξ 
                           
                             i 
                             , 
                             τ 
                             , 
                             ι 
                           
                         
                         := 
                         
                           - 
                           
                             
                               ∑ 
                               
                                 τ 
                                 = 
                                 1 
                               
                               
                                 m 
                                 - 
                                 1 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 ξ 
                                 
                                   i 
                                   , 
                                   τ 
                                   , 
                                   ι 
                                 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     i 
                                     = 
                                     1 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     L 
                                     ; 
                                     
                                       τ 
                                       = 
                                       0 
                                     
                                   
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           i 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         := 
                         
                           
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 0 
                               
                               
                                 
                                   μ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                                 - 
                                 1 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 δ 
                                 j 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               · 
                               
                                 a 
                                 
                                   i 
                                   , 
                                   j 
                                 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                   
                                   ) 
                                 
                               
                             
                           
                           + 
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               0 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           i 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         := 
                         
                           
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 0 
                               
                               
                                 
                                   μ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                                 - 
                                 1 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 δ 
                                 j 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               · 
                               
                                 b 
                                 
                                   i 
                                   , 
                                   j 
                                 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                   
                                   ) 
                                 
                               
                             
                           
                           + 
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               1 
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     131 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 205 : Key Element Generation Step) 
     With the processing device, concerning each integer τ of τ=1, . . . , m, each integer κ of κ=0, . . . , f τ , and each integer ι of ι=0, 1, the key element generation part  142  generates an element k* 0   (τ,κ,ι)  of the decryption key sk s , as indicated in Formula 132. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           η 
                           → 
                         
                         0 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     s 
                                     0 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   + 
                                   
                                     π 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                   
                                 
                                 , 
                                 
                                   
                                     e 
                                     → 
                                   
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                                 
                                   χ 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           * 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     132 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, for the bases B and B* indicated in Formula 113, Formula 114 is established. Hence, Formula 132 means that: s 0   (τ,κ,ι) +π τ,κ,ι  is set as the coefficient for a basis vector b* 0,1  of a basis B* 0 ; e →   0   (τ,κ,ι)  is set as the coefficient for basis vectors b* 0,1+1 , . . . , b* 0,1+n0  of the basis B* 0 ; 0 is set as the coefficient for basis vectors b* 0,n0+1 , . . . , b* 0,n0+,u0  of the basis B* 0 ; η 0,1   (τ,κ,ι) , . . . , η 0,w0   (τ,κ,ι)  are each set as the coefficient for basis vectors b* 0,n0+u0+1 , . . . , b* 0,n0+u0+w0  of the basis B* 0 ; and 0 is set as the coefficient for basis vectors b* 0,n0+u0+w0+1 , . . . , b* 0,n0+u0+w0+z0  of the basis B* 0 . Note that n0, u0, w0, and z0 respectively represent n 0 , u 0 , w 0 , and z 0 . 
     Also, e →   0   (τ,κ,ι)  is a 2mf max -dimensional vector in which 1 is set as the coefficient for one basis vector and 0 is set as the coefficient for another basis vector, and the basis vector for which 1 is set as the coefficient differs for each (τ,κ,ι). Likewise, e →   i   (τ,κ,ι)  is a 2mf max k max -dimensional vector in which 1 is set as the coefficient for one basis vector and 0 is set as the coefficient for another basis vector, and the basis vector for which 1 is set as the coefficient differs for each (τ,κ,ι). 
     Also, e →   1  is an n-dimensional vector in which 1 is set as the coefficient for the basis vector b* t,1  and 0 is set as the coefficient for another basis vector. 
     With the processing device, concerning each integer τ of τ=1, . . . , m, each integer κ of κ=0, . . . , f τ , each integer ι of ι=0, 1, and each integer i of i=1, . . . , L, the key element generation part  142  generates an element k* i   (τ,κ,ι)  of the decryption key sk s , as indicated in Formula 133. 
     
       
         
           
             
               
                 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     133 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 206 : Key Distribution Step) 
     For example, with the communication device, the key distribution part  150  distributes the decryption key sk S , constituted as elements by the access structure S inputted in (S 201 ) and k* 0   (τ,κ,ι) , k* 1   (τ,κ,ι) , . . . , k* L   (τ,κ,ι) , generated in (S 205 ), to the decryption device  300  in secrecy via the network. As a matter of course, the decryption key sk S  may be distributed to the decryption device  300  by another method. 
     In brief, from (S 201 ) through (S 205 ), the key generation device  100  generates the decryption key sk S  by executing the KeyGen algorithm indicated in Formulas 134 to 135. Then, in (S 206 ), the key generation device  100  distributes the generated decryption key sk S  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   KeyGen 
                   ( 
                   
                     pk 
                     , 
                     sk 
                     , 
                     
                       ?? 
                       ⁢ 
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           π 
                           τ 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     134 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           κ 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             
                               f 
                               τ 
                             
                             - 
                             κ 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     ( 
                     
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         a 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           a 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         κ 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         b 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           b 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           
                             f 
                             τ 
                           
                           - 
                           κ 
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       δ 
                       j 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         j 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         · 
                         
                           a 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             1 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         · 
                         
                           b 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       0 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               0 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                               
                                 χ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         m 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             1 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           · 
                           
                             a 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           · 
                           
                             b 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           1 
                         
                       
                     
                   
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     135 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         i 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       sk 
                       ?? 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         
                           
                             
                               ?? 
                               , 
                             
                           
                         
                         
                           
                             
                               
                                 { 
                                 
                                   
                                     k 
                                     0 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   , 
                                   
                                     k 
                                     1 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     k 
                                     L 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   , 
                                 
                                 } 
                               
                               
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   m 
                                   ; 
                                   
                                     κ 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   
                                     f 
                                     τ 
                                   
                                   ; 
                                   
                                     ι 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 1 
                               
                             
                           
                         
                       
                       ) 
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The function and operation of the encryption device  200  will be described. 
     The encryption device  200  is provided with a public parameter acquisition part  210 , an information input part  220 , an encrypted data generation part  230 , and a data transmission part  240 . 
     The process of the Enc algorithm will be described with reference to  FIG. 10 . 
     (S 301 : Public Parameter Acquisition Step) 
     For example, with the communication device, the public parameter acquisition part  210  acquires the public parameters pk generated by the key generation device  100 , via the network 
     (S 302 : Information Input Step) 
     With the input device, the information input part  220  takes as input the message msg to be transmitted to the decryption device  300 . Also, with the input device, the information input part  220  takes as input the attribute set Γ:={(t, x →   t  :=(x t,1 , . . . , x t,n εF q   n ))|1≦t≦d}. Note that t need not be all of the integers t falling within the range of 1≦t≦d, but may be one or more of integers t falling within the range of 1≦t≦d. Also, for example, decryptable user attribute information is set in the attribute set Γ. 
     (S 303 : Cipher Element Generation Step) 
     With the processing device, the encrypted data generation part  230  generates an element c 0  of the ciphertext ct Γ , as indicated in Formula 136. 
     
       
         
           
             
               
                 
                   ω 
                   , 
                   
                     ζ 
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         φ 
                         → 
                       
                       0 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         
                           z 
                           0 
                         
                         - 
                         1 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       0 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               ω 
                               , 
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 0 
                               
                               , 
                               ζ 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     136 
                   
                   ] 
                 
               
             
           
         
       
     
     With the processing device, concerning each integer t included in the attribute information Γ, the encrypted data generation part  230  generates an element c t  of the ciphertext ct Γ , as indicated in Formula 137. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           
                             
                               φ 
                               → 
                             
                             t 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             
                               z 
                               t 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         t 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   ω 
                                   ⁢ 
                                   
                                     
                                       x 
                                       → 
                                     
                                     t 
                                   
                                 
                                 , 
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 t 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   t 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           
                             ?? 
                             t 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     137 
                   
                   ] 
                 
               
             
           
         
       
     
     With the processing device, the encrypted data generation part  230  generates an element c d+1  of the ciphertext ct Γ , as indicated in Formula 138.
 
c d+1 :=g T   ζ msg  [Formula 138]
 
     (S 304 : Data Transmission Step) 
     For example, with the communication device, the data transmission part  240  transmits the ciphertext ct Γ , constituted as elements by the attribute set Γ inputted in (S 302 ) and c 0 , c t , and c d+1  generated in (S 303 ), to the decryption device  300  via the network. As a matter of course, the ciphertext ct Γ  may be transmitted to the decryption device  300  by another method. 
     In brief, from (S 301 ) through (S 303 ), the encryption device  200  generates the ciphertext ct Γ  by executing the Enc algorithm indicated in Formula 139. Then, in (S 304 ), the encryption device  200  transmits the generated ciphertext ct Γ  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       Enc 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           msg 
                           , 
                           
                             Γ 
                             := 
                             
                               { 
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   ) 
                                 
                                 | 
                                 
                                   1 
                                   ≤ 
                                   t 
                                   ≤ 
                                   d 
                                 
                               
                               } 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     ω 
                     , 
                     
                       ζ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           
                             z 
                             0 
                           
                           - 
                           1 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           
                             
                               φ 
                               → 
                             
                             t 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             
                               z 
                               t 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         0 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 ω 
                                 , 
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     φ 
                                     → 
                                   
                                   0 
                                 
                                 , 
                                 ζ 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         t 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   ω 
                                   ⁢ 
                                   
                                     
                                       x 
                                       → 
                                     
                                     t 
                                   
                                 
                                 , 
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 t 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   t 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           t 
                         
                       
                     
                     , 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         
                           d 
                           + 
                           1 
                         
                       
                       := 
                       
                         
                           g 
                           T 
                           ζ 
                         
                         ⁢ 
                         msg 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ct 
                           Γ 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             Γ 
                             , 
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 
                                   { 
                                   
                                     c 
                                     t 
                                   
                                   } 
                                 
                                 
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                     ∈ 
                                     Γ 
                                   
                                   , 
                                 
                               
                               ⁢ 
                               
                                 c 
                                 
                                   d 
                                   + 
                                   1 
                                 
                               
                             
                           
                           ) 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     139 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the decryption device  300  will be described. 
     The decryption device  300  is provided with an information acquisition part  310 , a span program calculation part  320 , a complementary coefficient calculation part  330 , and a decryption part  340 . The information acquisition part  310  is provided with a decryption key acquisition part  311  and a ciphertext acquisition part  312 . The complementary coefficient calculation part  330  is provided with a polynomial selection part  331  and a coefficient calculation part  332 . The decryption part  340  is provided with a pairing operation part  341  and a message calculation part  342 . 
     The process of the Dec algorithm will be described with reference to  FIG. 11 . 
     (S 401 : Decryption key Acquisition Step) 
     For example, with the communication device, the decryption key acquisition part  311  acquires the decryption key sk S :=(S, k* 0   (τ,κ,ι) , k* 1   (τ,κ,ι) , . . . , k* L   (τ,κ,ι) ) distributed by the key generation device  100 , via the network. The decryption key acquisition part  311  also acquires the public parameters pk generated by the key generation device  100 . 
     (S 402 : Ciphertext Acquisition Step) 
     For example, with the communication device, the ciphertext acquisition part  312  acquires the ciphertext ct Γ :=(Γ, c 0 , c t , c d+1 ) transmitted by the encryption device  200 , via the network. 
     (S 403 : Span Program Calculation Step) 
     With the processing device, the span program calculation part  320  checks whether or not the access structure S included in the decryption key sk S  acquired in (S 401 ) accepts Γ included in the ciphertext ct Γ  acquired in (S 402 ). The method of checking whether or not the access structure S accepts r is the same as that described in “2-1. Quadratic Span Program in Embodiment 1”. 
     The span program calculation part  320  advances to the process of (S 404 ) if the access structure S accepts Γ (accept in S 403 ). If the access structure S rejects Γ (reject in S 403 ), the span program calculation part  320  judges that the ciphertext ct Γ  cannot be decrypted, and ends the process. 
     (S 404 : Polynomial Selection Step) 
     With the processing device, the polynomial selection part  331  of the complementary coefficient calculation part  330  calculates I (ρ,Γ)   ⊂ {1, . . . , L}. The method of calculating I (ρ,Γ)  is the same as that described in “2-2. Inner-Product of Attributes and Quadratic Span Program in Embodiment 1”. 
     (S 405 : Coefficient Calculation Step) 
     With the processing device, the coefficient calculation part  332  of the complementary coefficient calculation part  330  calculates coefficients (α 1 , . . . , α L ), coefficients (β 1 , . . . , β L ), and degrees (κ 1 , . . . , κ m ) with which Formula 140 is established. The coefficients (α i , . . . , α L ), coefficients (β 1 , . . . , β L ), and degrees (κ 1 , . . . , κ m ) may be calculated by any method, for example, by round-robin.
 
Π τ=1   m d τ (x) κ     τ   |(a 0 (x)+Σ i=1   L α i a i (x)), and
 
Π τ=1   m d τ (x) ƒτ-κ     τ   |(b 0 (x)+Σ i=1   L β i b i (x))  [Formula 140]
 
     Note that α i =0=β i  concerning all i not included in I (ρ,Γ) . 
     (S 406 : Pairing Operation Step) 
     The pairing operation part  341  of the decryption part  340  generates session keys K τ,0  and K τ,1  by calculating Formula 141 with the processing device. 
     
       
         
           
             
               
                 
                   
                     
                       
                         K 
                         
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               ⁢ 
                               
                                 k 
                                 0 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       
                                         κ 
                                         τ 
                                       
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                   , 
                                   0 
                                 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     0 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     i 
                                     ∈ 
                                     
                                       ℐ 
                                       
                                         
                                           ( 
                                           
                                             ρ 
                                             , 
                                             Γ 
                                           
                                           ) 
                                         
                                         , 
                                         + 
                                       
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     · 
                                     
                                       
                                         ∏ 
                                         
                                           i 
                                           ∈ 
                                           
                                             ℐ 
                                             
                                               
                                                 ( 
                                                 
                                                   ρ 
                                                   , 
                                                   Γ 
                                                 
                                                 ) 
                                               
                                               , 
                                               - 
                                             
                                           
                                         
                                       
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           ⁡ 
                                           
                                             ( 
                                             
                                               
                                                 c 
                                                 t 
                                               
                                               , 
                                               
                                                 k 
                                                 i 
                                                 
                                                   * 
                                                   
                                                     ( 
                                                     
                                                       τ 
                                                       , 
                                                       
                                                         κ 
                                                         τ 
                                                       
                                                       , 
                                                       0 
                                                     
                                                     ) 
                                                   
                                                 
                                               
                                             
                                             ) 
                                           
                                         
                                         ⁢ 
                                         
                                           
                                             α 
                                             i 
                                           
                                           / 
                                           
                                             ( 
                                             
                                               
                                                 
                                                   v 
                                                   → 
                                                 
                                                 i 
                                               
                                               · 
                                               
                                                 
                                                   x 
                                                   → 
                                                 
                                                 i 
                                               
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               ⁢ 
                               
                                 k 
                                 0 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       
                                         κ 
                                         τ 
                                       
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                   , 
                                   0 
                                 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     0 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     i 
                                     ∈ 
                                     
                                       ℐ 
                                       
                                         
                                           ( 
                                           
                                             ρ 
                                             , 
                                             Γ 
                                           
                                           ) 
                                         
                                         , 
                                         + 
                                       
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 1 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       β 
                                       i 
                                     
                                     · 
                                     
                                       
                                         ∏ 
                                         
                                           i 
                                           ∈ 
                                           
                                             ℐ 
                                             
                                               
                                                 ( 
                                                 
                                                   ρ 
                                                   , 
                                                   Γ 
                                                 
                                                 ) 
                                               
                                               , 
                                               - 
                                             
                                           
                                         
                                       
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           ⁡ 
                                           
                                             ( 
                                             
                                               
                                                 c 
                                                 t 
                                               
                                               , 
                                               
                                                 k 
                                                 i 
                                                 
                                                   * 
                                                   
                                                     ( 
                                                     
                                                       τ 
                                                       , 
                                                       
                                                         κ 
                                                         τ 
                                                       
                                                       , 
                                                       1 
                                                     
                                                     ) 
                                                   
                                                 
                                               
                                             
                                             ) 
                                           
                                         
                                         ⁢ 
                                         
                                           
                                             β 
                                             i 
                                           
                                           / 
                                           
                                             ( 
                                             
                                               
                                                 
                                                   v 
                                                   → 
                                                 
                                                 i 
                                               
                                               · 
                                               
                                                 
                                                   x 
                                                   → 
                                                 
                                                 i 
                                               
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ℐ 
                           
                             
                               ( 
                               
                                 ρ 
                                 , 
                                 Γ 
                               
                               ) 
                             
                             , 
                             0 
                           
                         
                       
                       := 
                       
                         { 
                         
                           
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   ( 
                                   
                                     ρ 
                                     , 
                                     Γ 
                                   
                                   ) 
                                 
                               
                             
                             | 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                           = 
                           
                             p 
                             0 
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ℐ 
                         
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                           , 
                           + 
                         
                       
                       := 
                       
                         
                           { 
                           
                             
                               
                                 i 
                                 ∈ 
                                 
                                   ℐ 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                 
                               
                               | 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     v 
                                     _ 
                                   
                                   i 
                                 
                               
                               ) 
                             
                           
                           } 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ℐ 
                       
                         
                           ( 
                           
                             ρ 
                             , 
                             Γ 
                           
                           ) 
                         
                         , 
                         - 
                       
                     
                     := 
                     
                       { 
                       
                         
                           
                             i 
                             ∈ 
                             
                               ℐ 
                               
                                 ( 
                                 
                                   ρ 
                                   , 
                                   Γ 
                                 
                                 ) 
                               
                             
                           
                           | 
                           
                             ρ 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                         = 
                         
                           ⫬ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   _ 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                       
                       } 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     141 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 407 : Message Calculation Step) 
     The message calculation part  342  of the decryption part  340  generates a message msg′ (=msg) by calculating Formula 142 with the processing device. 
     
       
         
           
             
               
                 
                   
                     msg 
                     ′ 
                   
                   := 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     / 
                     
                       ( 
                       
                         
                           ∏ 
                           
                             τ 
                             = 
                             1 
                           
                           m 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             K 
                             
                               τ 
                               , 
                               0 
                             
                           
                           ⁢ 
                           
                             K 
                             
                               τ 
                               , 
                               1 
                             
                           
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     142 
                   
                   ] 
                 
               
             
           
         
       
     
     Note that by calculating Formula 141, g T   ζ  can be obtained, as indicated in Formula 143. Hence, by calculating Formula 142, the message msg′ (=msg) m can be obtained. 
     
       
         
           
             
               
                 
                   
                     
                       
                         
                           
                             K 
                             
                               τ 
                               , 
                               0 
                             
                           
                           := 
                             
                           ⁢ 
                           
                             e 
                             ⁢ 
                             
                               
                                 ( 
                                 
                                   
                                     c 
                                     0 
                                   
                                   ⁢ 
                                   
                                     k 
                                     0 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     i 
                                     ∈ 
                                     
                                       ℐ 
                                       
                                         
                                           ( 
                                           
                                             ρ 
                                             , 
                                             Γ 
                                           
                                           ) 
                                         
                                         , 
                                         0 
                                       
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           0 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     · 
                                   
                                 
                               
                             
                           
                         
                       
                     
                     
                       
                         
                             
                           ⁢ 
                           
                             
                               ∏ 
                               
                                 i 
                                 ∈ 
                                 
                                   ℐ 
                                   
                                     
                                       ( 
                                       
                                         ρ 
                                         , 
                                         Γ 
                                       
                                       ) 
                                     
                                     , 
                                     + 
                                   
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       t 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   α 
                                   i 
                                 
                                 · 
                               
                             
                           
                         
                       
                     
                     
                       
                         
                             
                           ⁢ 
                           
                             
                               
                                 ∏ 
                                 
                                   i 
                                   ∈ 
                                   
                                     ℐ 
                                     
                                       
                                         ( 
                                         
                                           ρ 
                                           , 
                                           Γ 
                                         
                                         ) 
                                       
                                       , 
                                       - 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 e 
                                 ⁢ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       t 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                                 ⁢ 
                                 
                                   
                                     α 
                                     i 
                                   
                                   / 
                                   
                                     ( 
                                     
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                       · 
                                       
                                         
                                           x 
                                           → 
                                         
                                         i 
                                       
                                     
                                     ) 
                                   
                                 
                               
                             
                             , 
                           
                         
                       
                     
                     
                       
                         
                           = 
                             
                           ⁢ 
                           
                             
                               g 
                               T 
                               
                                 
                                   ω 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           ∑ 
                                           
                                             j 
                                             = 
                                             0 
                                           
                                           
                                             
                                               μ 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                   , 
                                                   0 
                                                 
                                                 ) 
                                               
                                             
                                             - 
                                             1 
                                           
                                         
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           
                                             δ 
                                             j 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                           ⁢ 
                                           
                                             a 
                                             
                                               0 
                                               , 
                                               j 
                                             
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       + 
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           0 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   ζχ 
                                   
                                     τ 
                                     , 
                                     
                                       κ 
                                       τ 
                                     
                                     , 
                                     0 
                                   
                                 
                               
                             
                             · 
                           
                         
                       
                     
                     
                       
                         
                             
                           ⁢ 
                           
                             g 
                             T 
                             
                               
                                 ω 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         ∑ 
                                         
                                           i 
                                           = 
                                           1 
                                         
                                         L 
                                       
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         
                                           α 
                                           i 
                                         
                                         ⁢ 
                                         
                                           
                                             ∑ 
                                             
                                               j 
                                               = 
                                               0 
                                             
                                             
                                               
                                                 μ 
                                                 
                                                   ( 
                                                   
                                                     τ 
                                                     , 
                                                     
                                                       κ 
                                                       τ 
                                                     
                                                     , 
                                                     0 
                                                   
                                                   ) 
                                                 
                                               
                                               - 
                                               1 
                                             
                                           
                                           ⁢ 
                                           
                                               
                                           
                                           ⁢ 
                                           
                                             
                                               δ 
                                               j 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                   , 
                                                   0 
                                                 
                                                 ) 
                                               
                                             
                                             ⁢ 
                                             
                                               a 
                                               
                                                 i 
                                                 , 
                                                 j 
                                               
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                       
                                     
                                     + 
                                     
                                       ξ 
                                       
                                         i 
                                         , 
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               ) 
                             
                           
                         
                       
                     
                     
                       
                         
                           = 
                             
                           ⁢ 
                           
                             
                               g 
                               T 
                               
                                 
                                   ω 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           ∑ 
                                           
                                             j 
                                             = 
                                             0 
                                           
                                           
                                             
                                               μ 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                   , 
                                                   0 
                                                 
                                                 ) 
                                               
                                             
                                             - 
                                             1 
                                           
                                         
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           
                                             δ 
                                             j 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                           ⁢ 
                                           
                                             a 
                                             
                                               0 
                                               , 
                                               j 
                                             
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       + 
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           0 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   ζχ 
                                   
                                     τ 
                                     , 
                                     
                                       κ 
                                       τ 
                                     
                                     , 
                                     0 
                                   
                                 
                               
                             
                             · 
                           
                         
                       
                     
                     
                       
                         
                             
                           ⁢ 
                           
                             g 
                             T 
                             
                               ω 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     
                                       ∑ 
                                       
                                         j 
                                         = 
                                         0 
                                       
                                       
                                         
                                           μ 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               
                                                 κ 
                                                 τ 
                                               
                                               , 
                                               0 
                                             
                                             ) 
                                           
                                         
                                         - 
                                         1 
                                       
                                     
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         δ 
                                         j 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           ∑ 
                                           
                                             i 
                                             = 
                                             1 
                                           
                                           L 
                                         
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           
                                             α 
                                             i 
                                           
                                           ⁢ 
                                           
                                             a 
                                             
                                               i 
                                               , 
                                               j 
                                             
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                     
                                   
                                   + 
                                   
                                     
                                       α 
                                       i 
                                     
                                     ⁢ 
                                     
                                       ξ 
                                       
                                         i 
                                         , 
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                           
                         
                       
                     
                     
                       
                         
                           = 
                             
                           ⁢ 
                           
                             
                               g 
                               T 
                               
                                 ω 
                                 ( 
                                 
                                   
                                     ∑ 
                                     
                                       j 
                                       = 
                                       0 
                                     
                                     
                                       
                                         μ 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                       - 
                                       1 
                                     
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       δ 
                                       j 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           a 
                                           
                                             0 
                                             , 
                                             j 
                                           
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               
                                                 κ 
                                                 τ 
                                               
                                             
                                             ) 
                                           
                                         
                                         + 
                                         
                                           
                                             ∑ 
                                             
                                               i 
                                               = 
                                               1 
                                             
                                             L 
                                           
                                           ⁢ 
                                           
                                               
                                           
                                           ⁢ 
                                           
                                             
                                               α 
                                               i 
                                             
                                             ⁢ 
                                             
                                               a 
                                               
                                                 i 
                                                 , 
                                                 j 
                                               
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                             · 
                           
                         
                       
                     
                     
                       
                         
                             
                           ⁢ 
                           
                             g 
                             T 
                             
                               
                                 ωπ 
                                 
                                   τ 
                                   , 
                                   
                                     κ 
                                     τ 
                                   
                                   , 
                                   0 
                                 
                               
                               + 
                               
                                 ζχ 
                                 
                                   τ 
                                   , 
                                   
                                     κ 
                                     τ 
                                   
                                   , 
                                   0 
                                 
                               
                               + 
                               
                                 ω 
                                 ⁢ 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     L 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     ⁢ 
                                     
                                       ξ 
                                       
                                         i 
                                         , 
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     
                       
                         
                           = 
                             
                           ⁢ 
                           
                             g 
                             T 
                             
                               
                                 ωπ 
                                 
                                   τ 
                                   , 
                                   
                                     κ 
                                     τ 
                                   
                                   , 
                                   0 
                                 
                               
                               + 
                               
                                 ζχ 
                                 
                                   τ 
                                   , 
                                   
                                     κ 
                                     τ 
                                   
                                   , 
                                   0 
                                 
                               
                               + 
                               
                                 ω 
                                 ⁢ 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     L 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     ⁢ 
                                     
                                       ξ 
                                       
                                         i 
                                         , 
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       K 
                       
                         τ 
                         , 
                         1 
                       
                     
                     = 
                     
                       g 
                       T 
                       
                         
                           ωπ 
                           
                             τ 
                             , 
                             
                               κ 
                               τ 
                             
                             , 
                             1 
                           
                         
                         + 
                         
                           ζχ 
                           
                             τ 
                             , 
                             
                               κ 
                               τ 
                             
                             , 
                             1 
                           
                         
                         + 
                         
                           ω 
                           ⁢ 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               ⁢ 
                               
                                 ξ 
                                 
                                   i 
                                   , 
                                   τ 
                                   , 
                                   1 
                                 
                               
                             
                           
                         
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         
                           
                             
                               ∏ 
                               
                                 τ 
                                 = 
                                 1 
                               
                               m 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 K 
                                 
                                   τ 
                                   , 
                                   0 
                                 
                               
                               ⁢ 
                               
                                 K 
                                 
                                   τ 
                                   , 
                                   1 
                                 
                               
                             
                           
                           = 
                             
                           ⁢ 
                           
                             g 
                             T 
                             
                               
                                 ∑ 
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 m 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 ( 
                                 
                                   
                                     ω 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           π 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                         
                                         + 
                                         
                                           π 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             1 
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   + 
                                   
                                     ζ 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           χ 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                         
                                         + 
                                         
                                           χ 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             1 
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   + 
                                   
                                     ω 
                                     ⁢ 
                                     
                                       
                                         ∑ 
                                         
                                           i 
                                           = 
                                           1 
                                         
                                         L 
                                       
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         ( 
                                         
                                           
                                             
                                               α 
                                               i 
                                             
                                             ⁢ 
                                             
                                               ξ 
                                               
                                                 i 
                                                 , 
                                                 τ 
                                                 , 
                                                 0 
                                               
                                             
                                           
                                           + 
                                           
                                             
                                               β 
                                               i 
                                             
                                             ⁢ 
                                             
                                               ξ 
                                               
                                                 i 
                                                 , 
                                                 τ 
                                                 , 
                                                 1 
                                               
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                           
                         
                       
                     
                     
                       
                         
                           = 
                             
                           ⁢ 
                           
                             g 
                             T 
                             
                               ω 
                               ( 
                               
                                 
                                   
                                     ∑ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     π 
                                     τ 
                                   
                                 
                                 + 
                                 
                                   ζ 
                                   ⁢ 
                                   
                                     
                                       ∑ 
                                       
                                         τ 
                                         = 
                                         1 
                                       
                                       m 
                                     
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       χ 
                                       τ 
                                     
                                   
                                 
                                 + 
                                 
                                   ω 
                                   ⁢ 
                                   
                                     
                                       ∑ 
                                       
                                         i 
                                         = 
                                         1 
                                       
                                       L 
                                     
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         α 
                                         i 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             ∑ 
                                             
                                               τ 
                                               = 
                                               1 
                                             
                                             m 
                                           
                                           ⁢ 
                                           
                                               
                                           
                                           ⁢ 
                                           
                                             ξ 
                                             
                                               i 
                                               , 
                                               τ 
                                               , 
                                               0 
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 + 
                                 
                                   ω 
                                   ⁢ 
                                   
                                     
                                       ∑ 
                                       
                                         i 
                                         = 
                                         1 
                                       
                                       L 
                                     
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         β 
                                         i 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             ∑ 
                                             
                                               τ 
                                               = 
                                               1 
                                             
                                             m 
                                           
                                           ⁢ 
                                           
                                               
                                           
                                           ⁢ 
                                           
                                             ξ 
                                             
                                               i 
                                               , 
                                               τ 
                                               , 
                                               1 
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     
                       
                         
                           = 
                             
                           ⁢ 
                           
                             g 
                             T 
                             ζ 
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     143 
                   
                   ] 
                 
               
             
           
         
       
     
     In brief, from (S 401 ) through (S 407 ), the decryption device  300  generates the message msg′ (=msg) by executing the Dec algorithm indicated in Formula 144. 
     
       
         
           
             
               
                 
                   Dec 
                   ( 
                   
                     pk 
                     , 
                     
                       
                         sk 
                         ?? 
                       
                       := 
                       
                         
                           
                               
                             
                               
                                 ( 
                                 
                                   ?? 
                                   , 
                                   
                                     
                                       { 
                                       
                                         
                                           k 
                                           0 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                         , 
                                         
                                           k 
                                           1 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                         , 
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         , 
                                         
                                           k 
                                           L 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       } 
                                     
                                     
                                       
                                         τ 
                                         = 
                                         1 
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         m 
                                         ; 
                                         
                                           κ 
                                           = 
                                           0 
                                         
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         
                                           f 
                                           τ 
                                         
                                         ; 
                                         
                                           ι 
                                           = 
                                           0 
                                         
                                       
                                       , 
                                       1 
                                     
                                   
                                 
                                 ) 
                               
                               , 
                               
                                 
                                   ct 
                                   Γ 
                                 
                                 := 
                                 
                                   ( 
                                   
                                     Γ 
                                     , 
                                     
                                       c 
                                       0 
                                     
                                     , 
                                     
                                       
                                         { 
                                         
                                           c 
                                           t 
                                         
                                         } 
                                       
                                       
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               t 
                                             
                                           
                                           ) 
                                         
                                         ∈ 
                                         Γ 
                                       
                                     
                                     , 
                                     
                                       c 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             : 
                           
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           If 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ?? 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 ?? 
                                 , 
                                 ℬ 
                                 , 
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 , 
                                 ρ 
                               
                               ) 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             accepts 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             Γ 
                           
                           := 
                           
                             { 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     x 
                                     → 
                                   
                                   t 
                                 
                               
                               ) 
                             
                             } 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         then 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         compute 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ℐ 
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                         
                       
                       ⊆ 
                       
                         { 
                         
                           1 
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                         
                         } 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           α 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           α 
                           L 
                         
                       
                       ) 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ( 
                           
                             
                               β 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               β 
                               L 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         with 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           α 
                           i 
                         
                       
                       = 
                       
                         0 
                         = 
                         
                           
                             
                               β 
                               i 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             all 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                           ∉ 
                           
                             ℐ 
                             
                               ( 
                               
                                 ρ 
                                 , 
                                 Γ 
                               
                               ) 
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         and 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               κ 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               κ 
                               m 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         such 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         that 
                         ⁢ 
                         
                           
 
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               τ 
                               = 
                               1 
                             
                             m 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             
                               κ 
                               τ 
                             
                           
                         
                       
                       | 
                       
                         ( 
                         
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   a 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         and 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               τ 
                               = 
                               1 
                             
                             m 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               d 
                               τ 
                             
                             ⁢ 
                             
                               
                                 ( 
                                 x 
                                 ) 
                               
                               
                                 
                                   f 
                                   τ 
                                 
                                 - 
                                 
                                   κ 
                                   τ 
                                 
                               
                             
                           
                         
                       
                       | 
                       
                         ( 
                         
                           
                             
                               b 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   b 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         e 
                         ⁢ 
                         
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 0 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       
                                         κ 
                                         τ 
                                       
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                           · 
                           
                             
                               ∏ 
                               
                                 i 
                                 ∈ 
                                 
                                   ℐ 
                                   
                                     
                                       ( 
                                       
                                         ρ 
                                         , 
                                         Γ 
                                       
                                       ) 
                                     
                                     , 
                                     0 
                                   
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       0 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   α 
                                   i 
                                 
                                 · 
                                 
                                   
                                     ∏ 
                                     
                                       i 
                                       ∈ 
                                       
                                         ℐ 
                                         
                                           
                                             ( 
                                             
                                               ρ 
                                               , 
                                               Γ 
                                             
                                             ) 
                                           
                                           , 
                                           + 
                                         
                                       
                                     
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             c 
                                             t 
                                           
                                           , 
                                           
                                             k 
                                             i 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                   , 
                                                   0 
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                     ⁢ 
                                     
                                       
                                         α 
                                         i 
                                       
                                       · 
                                       
                                         
                                           ∏ 
                                           
                                             i 
                                             ∈ 
                                             
                                               ℐ 
                                               
                                                 
                                                   ( 
                                                   
                                                     ρ 
                                                     , 
                                                     Γ 
                                                   
                                                   ) 
                                                 
                                                 , 
                                                 - 
                                               
                                             
                                           
                                         
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           e 
                                           ⁢ 
                                           
                                             ( 
                                             
                                               
                                                 c 
                                                 t 
                                               
                                               , 
                                               
                                                 k 
                                                 i 
                                                 
                                                   * 
                                                   
                                                     ( 
                                                     
                                                       τ 
                                                       , 
                                                       
                                                         κ 
                                                         τ 
                                                       
                                                       , 
                                                       0 
                                                     
                                                     ) 
                                                   
                                                 
                                               
                                             
                                             ) 
                                           
                                           ⁢ 
                                           
                                             
                                               α 
                                               i 
                                             
                                             / 
                                             
                                               ( 
                                               
                                                 
                                                   
                                                     v 
                                                     → 
                                                   
                                                   i 
                                                 
                                                 · 
                                                 
                                                   
                                                     x 
                                                     → 
                                                   
                                                   i 
                                                 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           1 
                         
                       
                       := 
                       
                         e 
                         ⁢ 
                         
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 0 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       
                                         κ 
                                         τ 
                                       
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                           · 
                           
                             
                               ∏ 
                               
                                 i 
                                 ∈ 
                                 
                                   ℐ 
                                   
                                     
                                       ( 
                                       
                                         ρ 
                                         , 
                                         Γ 
                                       
                                       ) 
                                     
                                     , 
                                     0 
                                   
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       0 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             
                                               κ 
                                               τ 
                                             
                                             , 
                                             1 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   β 
                                   i 
                                 
                                 · 
                                 
                                   
                                     ∏ 
                                     
                                       i 
                                       ∈ 
                                       
                                         ℐ 
                                         
                                           
                                             ( 
                                             
                                               ρ 
                                               , 
                                               Γ 
                                             
                                             ) 
                                           
                                           , 
                                           + 
                                         
                                       
                                     
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             c 
                                             t 
                                           
                                           , 
                                           
                                             k 
                                             i 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   
                                                     κ 
                                                     τ 
                                                   
                                                   , 
                                                   1 
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                     ⁢ 
                                     
                                       
                                         β 
                                         i 
                                       
                                       · 
                                       
                                         
                                           ∏ 
                                           
                                             i 
                                             ∈ 
                                             
                                               ℐ 
                                               
                                                 
                                                   ( 
                                                   
                                                     ρ 
                                                     , 
                                                     Γ 
                                                   
                                                   ) 
                                                 
                                                 , 
                                                 - 
                                               
                                             
                                           
                                         
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           e 
                                           ⁢ 
                                           
                                             ( 
                                             
                                               
                                                 c 
                                                 t 
                                               
                                               , 
                                               
                                                 k 
                                                 i 
                                                 
                                                   * 
                                                   
                                                     ( 
                                                     
                                                       τ 
                                                       , 
                                                       
                                                         κ 
                                                         τ 
                                                       
                                                       , 
                                                       1 
                                                     
                                                     ) 
                                                   
                                                 
                                               
                                             
                                             ) 
                                           
                                           ⁢ 
                                           
                                             
                                               β 
                                               i 
                                             
                                             / 
                                             
                                               ( 
                                               
                                                 
                                                   
                                                     v 
                                                     → 
                                                   
                                                   i 
                                                 
                                                 · 
                                                 
                                                   
                                                     x 
                                                     → 
                                                   
                                                   i 
                                                 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ℐ 
                           
                             
                               ( 
                               
                                 ρ 
                                 , 
                                 Γ 
                               
                               ) 
                             
                             , 
                             0 
                           
                         
                       
                       := 
                       
                         { 
                         
                           
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   ( 
                                   
                                     ρ 
                                     , 
                                     Γ 
                                   
                                   ) 
                                 
                               
                             
                             | 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                           = 
                           
                             p 
                             0 
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ℐ 
                         
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                           , 
                           + 
                         
                       
                       := 
                       
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     ℐ 
                                     
                                       ( 
                                       
                                         ρ 
                                         , 
                                         Γ 
                                       
                                       ) 
                                     
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       v 
                                       _ 
                                     
                                     i 
                                   
                                 
                                 ) 
                               
                             
                             } 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           and 
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           
                             ℐ 
                             
                               
                                 ( 
                                 
                                   ρ 
                                   , 
                                   Γ 
                                 
                                 ) 
                               
                               , 
                               - 
                             
                           
                         
                         := 
                         
                           
                             
                               
                                 { 
                                 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         ℐ 
                                         
                                           ( 
                                           
                                             ρ 
                                             , 
                                             Γ 
                                           
                                           ) 
                                         
                                       
                                     
                                     | 
                                     
                                       ρ 
                                       ⁡ 
                                       
                                         ( 
                                         i 
                                         ) 
                                       
                                     
                                   
                                   = 
                                   
                                     ⫬ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           
                                             v 
                                             _ 
                                           
                                           i 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                                 } 
                               
                               . 
                               
                                 
 
                               
                               ⁢ 
                               return 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               msg 
                               ′ 
                             
                           
                           := 
                           
                             
                               c 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                             / 
                             
                               
                                 ( 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       K 
                                       
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                     ⁢ 
                                     
                                       K 
                                       
                                         τ 
                                         , 
                                         1 
                                       
                                     
                                   
                                 
                                 ) 
                               
                               . 
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     144 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, the cryptographic system  10  according to Embodiment 2 implements the functional encryption scheme that utilizes the quadratic span program. 
     By utilizing the quadratic span program, a wider range can be expressed as the relation R. 
     In particular, in the cryptographic system  10  according to Embodiment 2, for each polynomial d τ (x) fτ  obtained by factorizing the target polynomial d(x), an element which is a remainder of dividing a polynomial a i (x) by a polynomial d τ (x) κ  and an element which is a remainder of dividing a polynomial b i (x) by a polynomial d τ (x) fτ-κ  are treated as key elements k* 0   (τ,κ,ι) , k* 1   (τ,κ,ι) , . . . , k* L   (τ,κ,ι) . Also, secret information n and secret information χ are set by sharing in each key element k* 0   (τ,κ,ι) . Using the coefficients α and β, pairing operation of the key elements and the cipher elements is carried out to render the remainder set in each key element to 0, the secret information it to 0, and the secret information χ to 1, thereby extracting the session keys K τ,0  and K τ,1  from the ciphertext. This implements the functional encryption scheme that utilizes the quadratic span program. 
     The KP-FE scheme has been described above. If the KeyGen algorithm, Enc algorithm, and Dec algorithm are modified as indicated in Formulas 145 to 148, the CP-FE scheme may be realized. Note that the Setup algorithm is the same between the KP-FE scheme and the CP-FE scheme. 
     
       
         
           
             
               
                 
                   
                     
                       KeyGen 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           sk 
                           , 
                           
                             Γ 
                             := 
                             
                               { 
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   ) 
                                 
                                 | 
                                 
                                   1 
                                   ≤ 
                                   t 
                                   ≤ 
                                   d 
                                 
                               
                               } 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ω 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           
                             
                               φ 
                               → 
                             
                             t 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             
                               w 
                               t 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     145 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       k 
                       0 
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               ω 
                               , 
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 0 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                               1 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       t 
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 ω 
                                 ⁢ 
                                 
                                   
                                     x 
                                     → 
                                   
                                   t 
                                 
                               
                               , 
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 t 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               x 
                               → 
                             
                             t 
                           
                         
                         ) 
                       
                     
                     ∈ 
                     Γ 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         Γ 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           Γ 
                           , 
                           
                             k 
                             0 
                             * 
                           
                           , 
                           
                             
                               { 
                               
                                 k 
                                 t 
                                 * 
                               
                               } 
                             
                             
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       x 
                                       → 
                                     
                                     t 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               Γ 
                             
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   Enc 
                   ( 
                   
                     pk 
                     , 
                     msg 
                     , 
                     
                       ?? 
                       ⁢ 
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           π 
                           τ 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           π 
                           τ 
                         
                         - 
                         
                           
                             π 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                           
                           ⁢ 
                           
                             ( 
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 f 
                                 τ 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         χ 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         χ 
                         m 
                       
                       := 
                       
                         1 
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             χ 
                             τ 
                           
                         
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     146 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           κ 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             
                               f 
                               τ 
                             
                             - 
                             κ 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     ( 
                     
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                     
                     ) 
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         a 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           a 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         κ 
                       
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         b 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           b 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           
                             f 
                             τ 
                           
                           - 
                           κ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       δ 
                       j 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         j 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         
                           z 
                           0 
                         
                         - 
                         1 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         · 
                         
                           a 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         · 
                         
                           b 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       c 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 δχ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     147 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         m 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           · 
                           
                             a 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           · 
                           
                             b 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         t 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     := 
                     
                       
                         g 
                         T 
                         ζ 
                       
                       ⁢ 
                       msg 
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ct 
                       ?? 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         ?? 
                         , 
                         
                           
                             
                               { 
                               
                                 
                                   c 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   c 
                                   1 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   c 
                                   L 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 , 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   f 
                                   τ 
                                 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                           
                           ⁢ 
                           
                             c 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                       
                       ) 
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     Dec 
                     ⁡ 
                     
                       ( 
                       
                         pk 
                         , 
                         
                           
                             sk 
                             Γ 
                           
                           := 
                           
                             ( 
                             
                               Γ 
                               , 
                               
                                 k 
                                 0 
                                 * 
                               
                               , 
                               
                                 
                                   { 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                   } 
                                 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                   ∈ 
                                   Γ 
                                 
                               
                             
                             ) 
                           
                         
                         , 
                         
                           
                             ct 
                             ?? 
                           
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               
                                 
                                   { 
                                   
                                     
                                       c 
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                     , 
                                     
                                       c 
                                       1 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       c 
                                       L 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   } 
                                 
                                 
                                   
                                     τ 
                                     = 
                                     1 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     m 
                                     ; 
                                     
                                       κ 
                                       = 
                                       0 
                                     
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     
                                       f 
                                       τ 
                                     
                                     ; 
                                     
                                       ι 
                                       = 
                                       0 
                                     
                                   
                                   , 
                                   1 
                                 
                               
                               , 
                               
                                 c 
                                 
                                   d 
                                   + 
                                   1 
                                 
                               
                             
                             ) 
                           
                         
                       
                       ) 
                     
                   
                   ⁢ 
                   
                     : 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     148 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       If 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       ?? 
                     
                     := 
                     
                       
                         
                           ( 
                           
                             ?? 
                             , 
                             ℬ 
                             , 
                             
                               d 
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             , 
                             ρ 
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         accepts 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         Γ 
                       
                       := 
                       
                         { 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                         } 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       then 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       compute 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ℐ 
                         
                           ( 
                           
                             ρ 
                             , 
                             Γ 
                           
                           ) 
                         
                       
                     
                     ⊆ 
                     
                       { 
                       
                         1 
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         L 
                       
                       } 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         α 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         α 
                         L 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         ( 
                         
                           
                             β 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             β 
                             L 
                           
                         
                         ) 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       with 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         α 
                         i 
                       
                     
                     = 
                     
                       0 
                       = 
                       
                         
                           
                             β 
                             i 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           all 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           i 
                         
                         ∉ 
                         
                           ℐ 
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
                       
                         and 
                         ⁢ 
                         
                           
 
                         
                         ( 
                         
                           
                             κ 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             κ 
                             m 
                           
                         
                         ) 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       such 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ∏ 
                           
                             τ 
                             = 
                             1 
                           
                           m 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             κ 
                             τ 
                           
                         
                       
                     
                     | 
                     
                       ( 
                       
                         
                           
                             a 
                             0 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         + 
                         
                           
                             ∑ 
                             
                               i 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               α 
                               i 
                             
                             ⁢ 
                             
                               
                                 a 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                           
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       and 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ∏ 
                           
                             τ 
                             = 
                             1 
                           
                           m 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             d 
                             τ 
                           
                           ⁢ 
                           
                             
                               ( 
                               x 
                               ) 
                             
                             
                               
                                 f 
                                 τ 
                               
                               - 
                               
                                 κ 
                                 τ 
                               
                             
                           
                         
                       
                     
                     | 
                     
                       ( 
                       
                         
                           
                             b 
                             0 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         + 
                         
                           
                             ∑ 
                             
                               i 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               β 
                               i 
                             
                             ⁢ 
                             
                               
                                 b 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                           
                         
                       
                       ) 
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       K 
                       
                         τ 
                         , 
                         0 
                       
                     
                     := 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             
                               k 
                               0 
                             
                             ⁢ 
                             
                               c 
                               0 
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     
                                       κ 
                                       τ 
                                     
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                       
                       · 
                       
                         
                           ∏ 
                           
                             i 
                             ∈ 
                             
                               ℐ 
                               
                                 
                                   ( 
                                   
                                     ρ 
                                     , 
                                     Γ 
                                   
                                   ) 
                                 
                                 , 
                                 0 
                               
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   k 
                                   0 
                                 
                                 , 
                                 
                                   c 
                                   i 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         
                                           κ 
                                           τ 
                                         
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                 
                               
                               ) 
                             
                           
                           ⁢ 
                           
                             
                               α 
                               i 
                             
                             · 
                             
                               
                                 ∏ 
                                 
                                   i 
                                   ∈ 
                                   
                                     ℐ 
                                     
                                       
                                         ( 
                                         
                                           ρ 
                                           , 
                                           Γ 
                                         
                                         ) 
                                       
                                       , 
                                       + 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   e 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         k 
                                         t 
                                       
                                       , 
                                       
                                         c 
                                         i 
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               
                                                 κ 
                                                 τ 
                                               
                                               , 
                                               0 
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     α 
                                     i 
                                   
                                   · 
                                   
                                     
                                       ∏ 
                                       
                                         i 
                                         ∈ 
                                         
                                           ℐ 
                                           
                                             
                                               ( 
                                               
                                                 ρ 
                                                 , 
                                                 Γ 
                                               
                                               ) 
                                             
                                             , 
                                             - 
                                           
                                         
                                       
                                     
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         e 
                                         ⁡ 
                                         
                                           ( 
                                           
                                             
                                               k 
                                               t 
                                             
                                             , 
                                             
                                               c 
                                               i 
                                               
                                                 * 
                                                 
                                                   ( 
                                                   
                                                     τ 
                                                     , 
                                                     
                                                       κ 
                                                       τ 
                                                     
                                                     , 
                                                     0 
                                                   
                                                   ) 
                                                 
                                               
                                             
                                           
                                           ) 
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           α 
                                           i 
                                         
                                         / 
                                         
                                           ( 
                                           
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                             · 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               t 
                                             
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       K 
                       
                         τ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             
                               k 
                               0 
                             
                             ⁢ 
                             
                               c 
                               0 
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     
                                       κ 
                                       τ 
                                     
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                       
                       · 
                       
                         
                           ∏ 
                           
                             i 
                             ∈ 
                             
                               ℐ 
                               
                                 
                                   ( 
                                   
                                     ρ 
                                     , 
                                     Γ 
                                   
                                   ) 
                                 
                                 , 
                                 0 
                               
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   k 
                                   0 
                                 
                                 , 
                                 
                                   c 
                                   i 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         
                                           κ 
                                           τ 
                                         
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                 
                               
                               ) 
                             
                           
                           ⁢ 
                           
                             
                               β 
                               i 
                             
                             · 
                             
                               
                                 ∏ 
                                 
                                   i 
                                   ∈ 
                                   
                                     ℐ 
                                     
                                       
                                         ( 
                                         
                                           ρ 
                                           , 
                                           Γ 
                                         
                                         ) 
                                       
                                       , 
                                       + 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   e 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         k 
                                         t 
                                       
                                       , 
                                       
                                         c 
                                         i 
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               
                                                 κ 
                                                 τ 
                                               
                                               , 
                                               1 
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     β 
                                     i 
                                   
                                   · 
                                   
                                     
                                       ∏ 
                                       
                                         i 
                                         ∈ 
                                         
                                           ℐ 
                                           
                                             
                                               ( 
                                               
                                                 ρ 
                                                 , 
                                                 Γ 
                                               
                                               ) 
                                             
                                             , 
                                             - 
                                           
                                         
                                       
                                     
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         e 
                                         ⁡ 
                                         
                                           ( 
                                           
                                             
                                               k 
                                               t 
                                             
                                             , 
                                             
                                               c 
                                               i 
                                               
                                                 * 
                                                 
                                                   ( 
                                                   
                                                     τ 
                                                     , 
                                                     
                                                       κ 
                                                       τ 
                                                     
                                                     , 
                                                     1 
                                                   
                                                   ) 
                                                 
                                               
                                             
                                           
                                           ) 
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           β 
                                           i 
                                         
                                         / 
                                         
                                           ( 
                                           
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                             · 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               t 
                                             
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ℐ 
                           
                             
                               ( 
                               
                                 ρ 
                                 , 
                                 Γ 
                               
                               ) 
                             
                             , 
                             0 
                           
                         
                       
                       := 
                       
                         { 
                         
                           
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   ( 
                                   
                                     ρ 
                                     , 
                                     Γ 
                                   
                                   ) 
                                 
                               
                             
                             | 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                           = 
                           
                             p 
                             0 
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ℐ 
                         
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                           , 
                           + 
                         
                       
                       := 
                       
                         
                           { 
                           
                             
                               
                                 i 
                                 ∈ 
                                 
                                   ℐ 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                 
                               
                               | 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     v 
                                     _ 
                                   
                                   i 
                                 
                               
                               ) 
                             
                           
                           } 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ℐ 
                       
                         
                           ( 
                           
                             ρ 
                             , 
                             Γ 
                           
                           ) 
                         
                         , 
                         - 
                       
                     
                     := 
                     
                       
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     ℐ 
                                     
                                       ( 
                                       
                                         ρ 
                                         , 
                                         Γ 
                                       
                                       ) 
                                     
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         v 
                                         _ 
                                       
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                             } 
                           
                           . 
                           
                             
 
                           
                           ⁢ 
                           return 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           msg 
                           ′ 
                         
                       
                       := 
                       
                         
                           c 
                           
                             d 
                             + 
                             1 
                           
                         
                         / 
                         
                           
                             ( 
                             
                               
                                 ∏ 
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 m 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     0 
                                   
                                 
                                 ⁢ 
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     1 
                                   
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The functional encryption scheme has been described above. If the Setup algorithm, KeyGen algorithm, Enc algorithm, and Dec algorithm are modified as indicated in Formulas 149 to 153, an attribute-based encryption scheme may be realized. 
     With the attribute-based encryption scheme, in the Setup algorithm, n t  is 2mf max k max +2. 
     
       
         
           
             
               
                 
                   
                     
                       Setup 
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ( 
                       
                         param 
                         , 
                         
                           
                             ( 
                             
                               
                                 ?? 
                                 t 
                               
                               , 
                               
                                 ?? 
                                 t 
                                 * 
                               
                             
                             ) 
                           
                           
                             
                               t 
                               = 
                               0 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             d 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       ⟵ 
                       R 
                     
                     ⁢ 
                     
                       
                         ?? 
                         ob 
                       
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         
                           ?? 
                           ^ 
                         
                         0 
                       
                       := 
                       
                         ( 
                         
                           
                             b 
                             
                               0 
                               , 
                               1 
                             
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               
                                 
                                   n 
                                   0 
                                 
                                 + 
                                 
                                   u 
                                   0 
                                 
                                 + 
                                 
                                   w 
                                   0 
                                 
                                 + 
                                 1 
                               
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               
                                 
                                   n 
                                   0 
                                 
                                 + 
                                 
                                   u 
                                   0 
                                 
                                 + 
                                 
                                   w 
                                   0 
                                 
                                 + 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ?? 
                           ^ 
                         
                         t 
                       
                       := 
                       
                         ( 
                         
                           
                             b 
                             
                               t 
                               , 
                               1 
                             
                           
                           , 
                           
                             b 
                             
                               t 
                               , 
                               2 
                             
                           
                           , 
                           
                             b 
                             
                               t 
                               , 
                               
                                 
                                   n 
                                   t 
                                 
                                 + 
                                 
                                   u 
                                   t 
                                 
                                 + 
                                 
                                   w 
                                   t 
                                 
                                 + 
                                 1 
                               
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             b 
                             
                               t 
                               , 
                               
                                 
                                   n 
                                   t 
                                 
                                 + 
                                 
                                   u 
                                   t 
                                 
                                 + 
                                 
                                   w 
                                   t 
                                 
                                 + 
                                 
                                   z 
                                   t 
                                 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     d 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ?? 
                           ^ 
                         
                         0 
                         * 
                       
                       := 
                       
                         ( 
                         
                           
                             b 
                             
                               0 
                               , 
                               1 
                             
                             * 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               
                                 n 
                                 0 
                               
                             
                             * 
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               
                                 
                                   n 
                                   0 
                                 
                                 + 
                                 
                                   u 
                                   0 
                                 
                                 + 
                                 1 
                               
                             
                             * 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               
                                 
                                   n 
                                   0 
                                 
                                 + 
                                 
                                   u 
                                   0 
                                 
                                 + 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             * 
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               
                                 
                                   n 
                                   0 
                                 
                                 + 
                                 
                                   u 
                                   0 
                                 
                                 + 
                                 
                                   w 
                                   0 
                                 
                                 + 
                                 
                                   z 
                                   0 
                                 
                               
                             
                             * 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ?? 
                           ^ 
                         
                         t 
                         * 
                       
                       := 
                       
                         ( 
                         
                           
                             b 
                             
                               t 
                               , 
                               1 
                             
                             * 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             b 
                             
                               t 
                               , 
                               
                                 n 
                                 t 
                               
                             
                             * 
                           
                           , 
                           
                             b 
                             
                               t 
                               , 
                               
                                 
                                   n 
                                   t 
                                 
                                 + 
                                 
                                   u 
                                   t 
                                 
                                 + 
                                 1 
                               
                             
                             * 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             b 
                             
                               t 
                               , 
                               
                                 
                                   n 
                                   t 
                                 
                                 + 
                                 
                                   u 
                                   t 
                                 
                                 + 
                                 
                                   w 
                                   t 
                                 
                               
                             
                             * 
                           
                         
                         ) 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     d 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         pk 
                       
                       := 
                       
                         ( 
                         
                           
                             1 
                             λ 
                           
                           , 
                           
                             
                               { 
                               
                                 
                                   ?? 
                                   ^ 
                                 
                                 t 
                               
                               } 
                             
                             
                               
                                 t 
                                 = 
                                 0 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                           , 
                           param 
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       sk 
                       := 
                       
                         
                           
                             { 
                             
                               
                                 ?? 
                                 ^ 
                               
                               t 
                               * 
                             
                             } 
                           
                           
                             
                               t 
                               = 
                               0 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             d 
                           
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     149 
                   
                   ] 
                 
               
             
             
               
                 
                   KeyGen 
                   ( 
                   
                     pk 
                     , 
                     sk 
                     , 
                     
                       ?? 
                       ⁢ 
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           π 
                           τ 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     150 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           κ 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             
                               f 
                               τ 
                             
                             - 
                             κ 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     ( 
                     
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                     
                     ) 
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         a 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           a 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         κ 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         b 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           b 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           
                             f 
                             τ 
                           
                           - 
                           κ 
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       δ 
                       j 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         j 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         · 
                         
                           a 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             1 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         · 
                         
                           b 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       0 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               0 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               , 
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                               
                                 χ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     151 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         m 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           · 
                           
                             a 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           · 
                           
                             b 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           v 
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     v 
                                     i 
                                   
                                 
                               
                               , 
                               
                                 - 
                                 
                                   θ 
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             v 
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   v 
                                   i 
                                 
                               
                               , 
                               
                                 
                                   - 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     → 
                                   
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       sk 
                       ?? 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         
                           
                             
                               ?? 
                               , 
                             
                           
                         
                         
                           
                             
                               
                                 { 
                                 
                                   
                                     k 
                                     0 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   , 
                                   
                                     k 
                                     1 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     k 
                                     L 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   , 
                                 
                                 } 
                               
                               
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   m 
                                   ; 
                                   
                                     κ 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   
                                     f 
                                     τ 
                                   
                                   ; 
                                   
                                     ι 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 1 
                               
                             
                           
                         
                       
                       ) 
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       Enc 
                       ⁢ 
                       
                         ( 
                         
                           pk 
                           , 
                           msg 
                           , 
                           
                             Γ 
                             := 
                             
                               { 
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       x 
                                       t 
                                     
                                   
                                   ) 
                                 
                                 | 
                                 
                                   1 
                                   ≤ 
                                   t 
                                   ≤ 
                                   d 
                                 
                               
                               } 
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       ω 
                       , 
                       
                         ζ 
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             → 
                           
                           0 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           
                             
                               z 
                               0 
                             
                             - 
                             1 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 φ 
                                 → 
                               
                               t 
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                               
                                 z 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           0 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   ω 
                                   , 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     0 
                                   
                                   , 
                                   ζ 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             0 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           t 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     ω 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         1 
                                         , 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                   , 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     φ 
                                     → 
                                   
                                   t 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     t 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             t 
                           
                         
                       
                       , 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           
                             d 
                             + 
                             1 
                           
                         
                         := 
                         
                           
                             g 
                             T 
                             ζ 
                           
                           ⁢ 
                           msg 
                         
                       
                       , 
                       
                         
                           ct 
                           Γ 
                         
                         := 
                         
                           ( 
                           
                             Γ 
                             , 
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 
                                   { 
                                   
                                     c 
                                     t 
                                   
                                   } 
                                 
                                 
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                     ∈ 
                                     Γ 
                                   
                                   , 
                                 
                               
                               ⁢ 
                               
                                 c 
                                 
                                   d 
                                   + 
                                   1 
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ct 
                             Γ 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     152 
                   
                   ] 
                 
               
             
             
               
                 
                   Dec 
                   ( 
                   
                     pk 
                     , 
                     
                       
                         sk 
                         ?? 
                       
                       := 
                       
                         
                             
                           
                             
                               ( 
                               
                                 
                                   
                                     
                                       ?? 
                                       , 
                                     
                                   
                                 
                                 
                                   
                                     
                                       
                                         { 
                                         
                                           
                                             k 
                                             0 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   κ 
                                                   , 
                                                   ι 
                                                 
                                                 ) 
                                               
                                             
                                           
                                           , 
                                           
                                             k 
                                             1 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   κ 
                                                   , 
                                                   ι 
                                                 
                                                 ) 
                                               
                                             
                                           
                                           , 
                                           … 
                                           ⁢ 
                                           
                                               
                                           
                                           , 
                                           
                                             k 
                                             L 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   κ 
                                                   , 
                                                   ι 
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                         } 
                                       
                                       
                                         
                                           τ 
                                           = 
                                           1 
                                         
                                         , 
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         , 
                                         
                                           m 
                                           ; 
                                           
                                             κ 
                                             = 
                                             0 
                                           
                                         
                                         , 
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         , 
                                         
                                           
                                             f 
                                             τ 
                                           
                                           ; 
                                           
                                             ι 
                                             = 
                                             0 
                                           
                                         
                                         , 
                                         1 
                                       
                                     
                                   
                                 
                               
                               ) 
                             
                             , 
                             
                               
                                 ct 
                                 Γ 
                               
                               := 
                               
                                 ( 
                                 
                                   Γ 
                                   , 
                                   
                                     c 
                                     0 
                                   
                                   , 
                                   
                                     
                                       { 
                                       
                                         c 
                                         t 
                                       
                                       } 
                                     
                                     
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             x 
                                             t 
                                           
                                         
                                         ) 
                                       
                                       ∈ 
                                       Γ 
                                     
                                   
                                   , 
                                   
                                     c 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           : 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     153 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         If 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ?? 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 d 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           accepts 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           Γ 
                         
                         := 
                         
                           { 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                           } 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         then 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         compute 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ℐ 
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                         
                       
                       ⊆ 
                       
                         { 
                         
                           1 
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                         
                         } 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           α 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           α 
                           L 
                         
                       
                       ) 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ( 
                           
                             
                               β 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               β 
                               L 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         with 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           α 
                           i 
                         
                       
                       = 
                       
                         0 
                         = 
                         
                           
                             
                               β 
                               i 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             all 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                           ∉ 
                           
                             ℐ 
                             
                               ( 
                               
                                 ρ 
                                 , 
                                 Γ 
                               
                               ) 
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       and 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           
                             κ 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             κ 
                             m 
                           
                         
                         ) 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       such 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         
                           ∏ 
                           
                             τ 
                             = 
                             1 
                           
                           m 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             κ 
                             τ 
                           
                         
                       
                       | 
                       
                         ( 
                         
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   a 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         and 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               τ 
                               = 
                               1 
                             
                             m 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               d 
                               τ 
                             
                             ⁢ 
                             
                               
                                 ( 
                                 x 
                                 ) 
                               
                               
                                 
                                   f 
                                   τ 
                                 
                                 - 
                                 
                                   κ 
                                   τ 
                                 
                               
                             
                           
                         
                       
                       | 
                       
                         ( 
                         
                           
                             
                               b 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   b 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       K 
                       
                         τ 
                         , 
                         0 
                       
                     
                     := 
                     
                       e 
                       ⁢ 
                       
                         
                           ( 
                           
                             
                               c 
                               0 
                             
                             ⁢ 
                             
                               k 
                               0 
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     
                                       κ 
                                       τ 
                                     
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           
                             ∏ 
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                   , 
                                   0 
                                 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     0 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     i 
                                     ∈ 
                                     
                                       ℐ 
                                       
                                         
                                           ( 
                                           
                                             ρ 
                                             , 
                                             Γ 
                                           
                                           ) 
                                         
                                         , 
                                         + 
                                       
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     · 
                                     
                                       
                                         ∏ 
                                         
                                           i 
                                           ∈ 
                                           
                                             ℐ 
                                             
                                               
                                                 ( 
                                                 
                                                   ρ 
                                                   , 
                                                   Γ 
                                                 
                                                 ) 
                                               
                                               , 
                                               - 
                                             
                                           
                                         
                                       
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         e 
                                         ⁢ 
                                         
                                           ( 
                                           
                                             
                                               c 
                                               t 
                                             
                                             , 
                                             
                                               k 
                                               i 
                                               
                                                 * 
                                                 
                                                   ( 
                                                   
                                                     τ 
                                                     , 
                                                     
                                                       κ 
                                                       τ 
                                                     
                                                     , 
                                                     0 
                                                   
                                                   ) 
                                                 
                                               
                                             
                                           
                                           ) 
                                         
                                         ⁢ 
                                         
                                           
                                             α 
                                             i 
                                           
                                           / 
                                           
                                             ( 
                                             
                                               
                                                 v 
                                                 i 
                                               
                                               · 
                                               
                                                 x 
                                                 t 
                                               
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       K 
                       
                         τ 
                         , 
                         1 
                       
                     
                     := 
                     
                       e 
                       ⁢ 
                       
                         
                           ( 
                           
                             
                               c 
                               0 
                             
                             ⁢ 
                             
                               k 
                               0 
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     
                                       κ 
                                       τ 
                                     
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           
                             ∏ 
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                   , 
                                   0 
                                 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     0 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             κ 
                                             τ 
                                           
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     i 
                                     ∈ 
                                     
                                       ℐ 
                                       
                                         
                                           ( 
                                           
                                             ρ 
                                             , 
                                             Γ 
                                           
                                           ) 
                                         
                                         , 
                                         + 
                                       
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 
                                                   κ 
                                                   τ 
                                                 
                                                 , 
                                                 1 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       β 
                                       i 
                                     
                                     · 
                                     
                                       
                                         ∏ 
                                         
                                           i 
                                           ∈ 
                                           
                                             ℐ 
                                             
                                               
                                                 ( 
                                                 
                                                   ρ 
                                                   , 
                                                   Γ 
                                                 
                                                 ) 
                                               
                                               , 
                                               - 
                                             
                                           
                                         
                                       
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         e 
                                         ⁢ 
                                         
                                           ( 
                                           
                                             
                                               c 
                                               t 
                                             
                                             , 
                                             
                                               k 
                                               i 
                                               
                                                 * 
                                                 
                                                   ( 
                                                   
                                                     τ 
                                                     , 
                                                     
                                                       κ 
                                                       τ 
                                                     
                                                     , 
                                                     1 
                                                   
                                                   ) 
                                                 
                                               
                                             
                                           
                                           ) 
                                         
                                         ⁢ 
                                         
                                           
                                             β 
                                             i 
                                           
                                           / 
                                           
                                             ( 
                                             
                                               
                                                 v 
                                                 i 
                                               
                                               · 
                                               
                                                 x 
                                                 t 
                                               
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ℐ 
                           
                             
                               ( 
                               
                                 ρ 
                                 , 
                                 Γ 
                               
                               ) 
                             
                             , 
                             0 
                           
                         
                       
                       := 
                       
                         { 
                         
                           
                             
                               i 
                               ∈ 
                               
                                 ℐ 
                                 
                                   ( 
                                   
                                     ρ 
                                     , 
                                     Γ 
                                   
                                   ) 
                                 
                               
                             
                             | 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                           = 
                           
                             p 
                             0 
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ℐ 
                         
                           
                             ( 
                             
                               ρ 
                               , 
                               Γ 
                             
                             ) 
                           
                           , 
                           + 
                         
                       
                       := 
                       
                         
                           { 
                           
                             
                               
                                 i 
                                 ∈ 
                                 
                                   ℐ 
                                   
                                     ( 
                                     
                                       ρ 
                                       , 
                                       Γ 
                                     
                                     ) 
                                   
                                 
                               
                               | 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   v 
                                   i 
                                 
                               
                               ) 
                             
                           
                           } 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ℐ 
                       
                         
                           ( 
                           
                             ρ 
                             , 
                             Γ 
                           
                           ) 
                         
                         , 
                         - 
                       
                     
                     := 
                     
                       
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     ℐ 
                                     
                                       ( 
                                       
                                         ρ 
                                         , 
                                         Γ 
                                       
                                       ) 
                                     
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       v 
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                             } 
                           
                           . 
                           
                             
 
                           
                           ⁢ 
                           return 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           msg 
                           ′ 
                         
                       
                       := 
                       
                         
                           c 
                           
                             d 
                             + 
                             1 
                           
                         
                         / 
                         
                           
                             ( 
                             
                               
                                 ∏ 
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 m 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     0 
                                   
                                 
                                 ⁢ 
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     1 
                                   
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     Likewise, the CP-FE scheme indicated in Formulas 145 to 148 can be altered to the attribute-based encryption scheme. 
     In the above explanation, n 0 +u 0 +w 0 +z 0  is set in N 0  and n t +u t +w t +z t  is set in N t . It for example, u 0 =n 0 , w 0 =n 0 , and z 0 =2, then n 0 +n 0 +n 0 +2=3n 0 +2 may be set in N 0 . If u t =n t , w t =n t , and z t =1, then n t +n t +n t +1=3n t +1 may be set in N t . 
     Embodiment 3. 
     Embodiment 3 will exemplify a functional encryption scheme in which, as compared to the functional encryption scheme described in Embodiment 2, the number of bases increases but the dimension number of each basis decreases. 
     Explanation will be given in Embodiment 3 mainly on portions that are different from the cryptographic system  10  according to Embodiment 2. 
     The configurations of a key generation device  100 , an encryption device  200 , and a decryption device  300  according to Embodiment 3 are respectively the same as the configurations of the key generation device  100 , the encryption device  200 , and the decryption device  300  according to Embodiment 2 shown in  FIGS. 5 and 7 . 
     The process of a Dec algorithm according to Embodiment 3 is the same as the process of the Dec algorithm according to Embodiment 2. Hence, the processes of a Setup algorithm, KeyGen algorithm, and Enc algorithm according to Embodiment 3 will be described. 
     The process flows of the Setup algorithm, KeyGen algorithm, and Enc algorithm according to Embodiment 3 are the same as the process flows of the Setup algorithm, KeyGen algorithm, and Enc algorithm according to Embodiment 2 shown in  FIGS. 8 to 10 . 
     The process of the Setup algorithm will be described with reference to  FIG. 8 . 
     (S 101 : Orthogonal Basis Generation Step) 
     The processes of (1) to (3) are the same as those in Embodiment 2. 
     (4) A master key generation part  110  sets n 0 +u 0 +w 0 +z 0  in N 0 , and sets n t +u t +w t +z t  in N t  concerning each integer t of t=1, . . . , d (d is an integer of 1 or more). Note that n 0  is 1 and n t  is n where: n is an integer of 1 or more and u 0 , w 0 , z 0 , u t , w t , and z t  are each an integer of 0 or more. 
     Subsequently, the master key generation part  110  executes processes (5) to (9) concerning integers τ, κ, ι, and t of τ=1 . . . , m, κ=0, . . . , f τ , t=0, 1, and t=0, . . . , d. 
     The process of (5) is the same as that in Embodiment 2. 
     (6) The master key generation part  110  generates linear transformation X t   (τ,κ,ι) :=(χ t,i,j   (τ,κ,ι)   i,j  randomly, in the same manner as in Embodiment 2. 
     (7) The master key generation part  110  generates X* t   (τ,κ,ι) :=(ν t,i,j   (τ,κ,ι) ) i,j :=ψ(X t   (τ,κ,ι)T ) −1 , in the same manner as in Embodiment 2. 
     (8) Based on the linear transformation X t   (τ,κ,ι)  generated in (6), the master key generation part  110  generates a basis B t   (τ,κ,ι)  from a canonical basis A t  generated in (5), in the same manner as in Embodiment 2. 
     (9) Based on the linear transformation X* t   (τ,κ,ι)  generated in (7), the master key generation part  110  generates a basis B* t   (τ,κ,ι)  from the canonical basis A t  generated in (5), in the same manner as in Embodiment 2. 
     The process of (10) is the same as that in Embodiment 2. 
     (S 102 : Public Parameter Generation Step) 
     With the processing device, the master key generation part  110  generates subbases B^ 0   (τ,κ,ι)  and B^ t   (τ,κ,ι)  of the bases B 0   (τ,κ,ι)  and B t   (τ,κ,ι) , respectively, which are generated in (S 101 ), as indicated in Formula 154.
 
             0   (τ,κ,ι)   :=b   0,1   (τ,κ,ι)   ,b   0,n     0     +u     0     +w     0     +1   (τ,κ,ι)   , . . . ,b   0,n     0     +u     0     +w     0     +z     0     (τ,κ,ι) ),
 
           t   (τ,κ,ι) :=( b   t,1   (τ,κ,ι)   , . . . ,b   t,n   (τ,κ,ι)   ,b   t,n     t     +u     t     +w     t     +1   (τ,κ,ι)   , . . . ,b   t,n     t     +u     t     +w     t     +z     t     (τ,κ,ι) )  [Formula 154]
       for t=1, . . . , d       

     The master key generation part  110  treats the generated subbases B^ 0   (τ,κ,ι)  and B^ t   (τ,κ,ι) , the security parameter λ inputted in (S 101 ), and param generated in (S 101 ), to form public parameters pk. 
     (S 103 : Master Key Generation Step) 
     With the processing device, the master key generation part  110  generates subbases B^* 0   (τ,κ,ι)  and B^* t   (τ,κ,ι)  of the bases B* 0   (τ,κ,ι)  and B* t   (τ,κ,ι) , respectively, which are generated in (S 101 ), as indicated in Formula 155.
 
           * 0   (τ,κ,ι) :=( b*   0,1   (τ,κ,ι)   , . . . ,b*   0,n     0     (τ,κ,ι)   ,b*   0,n     0     +u     0     +1   (τ,κ,ι)   , . . . ,b*   0,n     0     +u     0     +w     0     (τ,κ,ι)   ,b*   0,n     0     +u     0     +w     0     +z     0     (τ,κ,ι) ),
 
         * t   (τ,κ,ι) :=( b*   t,1   (τ,κ,ι)   , . . . ,b*   t,n     t     (τ,κ,ι)   ,b*   t,n     t     +u     t     +1   (τ,κ,ι)   , . . . ,b*   t,n     t     +u     t     +w     t     (τ,κ,ι) )  [Formula 155]
       for t=1, . . . , d       

     The master key generation part  110  treats the generated subbases B^* 0   (τ,κ,ι)  and B^* t   (τ,κ,ι) , to form the master key sk. 
     The process of (S 104 ) is the same as that in Embodiment 2. 
     In brief, from (S 101 ) through (S 103 ), the key generation device  100  generates the public parameters pk and the master key sk by executing the Setup algorithm indicated in Formula 156. Then, in (S 104 ), the key generation device  100  stores the generated public parameters pk and master key sk, in the storage device. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Setup 
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ( 
                           
                             param 
                             , 
                             
                               
                                 ( 
                                 
                                   
                                     ?? 
                                     t 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     ?? 
                                     t 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                               
                                 
                                   t 
                                   = 
                                   0 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   d 
                                   ; 
                                   
                                     τ 
                                     = 
                                     1 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   m 
                                   ; 
                                   
                                     κ 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   
                                     f 
                                     τ 
                                   
                                   ; 
                                   
                                     ι 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 1 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ⟵ 
                           R 
                         
                         ⁢ 
                         
                           
                             ?? 
                             ob 
                           
                           ⁡ 
                           
                             ( 
                             
                               1 
                               λ 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           τ 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           m 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           κ 
                         
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                       , 
                       
                           
                       
                       ⁢ 
                       
                         ι 
                         = 
                         0 
                       
                       , 
                       1 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           t 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 n 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                   + 
                                   
                                     z 
                                     t 
                                   
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                           
                             * 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   n 
                                   0 
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           t 
                           
                             * 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   n 
                                   t 
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           pk 
                         
                         := 
                         
                           ( 
                           
                             
                               1 
                               λ 
                             
                             , 
                             
                               
                                 { 
                                 
                                   
                                     ?? 
                                     ^ 
                                   
                                   t 
                                 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   0 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                             
                             , 
                             param 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         := 
                         
                           
                             
                               { 
                               
                                 
                                   ?? 
                                   ^ 
                                 
                                 t 
                                 * 
                               
                               } 
                             
                             
                               
                                 t 
                                 = 
                                 0 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     156 
                   
                   ] 
                 
               
             
           
         
       
     
     The process of the KeyGen algorithm will be described with reference to  FIG. 9 . 
     The processes of (S 201 ) through (S 204 ) and of (S 206 ) are the same as those in Embodiment 2. 
     (S 205 : Key Element Generation Step) 
     With the processing device, concerning each integer τ of τ=1 . . . , m, each integer κ of κ=0, . . . , f τ , and each integer ι of ι=0, 1, a key element generation part  142  generates an element k* 0   (τ,κ,ι)  of a decryption key sk s , as indicated in Formula 157. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           η 
                           → 
                         
                         0 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                                 
                                   χ 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           
                             * 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     157 
                   
                   ] 
                 
               
             
           
         
       
     
     With the processing device, concerning each integer τ of τ=1 . . . , m, each integer κ of κ=0, . . . , f τ , each integer ι of ι=0, 1, and each integer i of i=1, . . . , L, the key element generation part  142  generates an element k* i   (τ,κ,ι)  of the decryption key sk s , as indicated in Formula 158. 
     
       
         
           
             
               
                 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     → 
                                   
                                   1 
                                 
                               
                               + 
                               
                                 
                                   θ 
                                   i 
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               s 
                               i 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           , 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     158 
                   
                   ] 
                 
               
             
           
         
       
     
     In brief, from (S 201 ) through (S 205 ), the key generation device  100  generates the decryption key sk s  by executing the KeyGen algorithm indicated in Formulas 159 to 160. Then, in (S 206 ), the key generation device  100  distributes the generated decryption key sk s  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       KeyGen 
                       ( 
                       
                         pk 
                         , 
                         sk 
                         , 
                         
                           ?? 
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         x 
                                         ) 
                                       
                                     
                                     
                                       f 
                                       τ 
                                     
                                   
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         π 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     159 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           κ 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             
                               f 
                               τ 
                             
                             - 
                             κ 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ( 
                     
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         a 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           a 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         κ 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         b 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             k 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           b 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           
                             f 
                             τ 
                           
                           - 
                           κ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       δ 
                       j 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         j 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           η 
                           → 
                         
                         0 
                       
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         · 
                         
                           a 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         · 
                         
                           b 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       0 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                               
                                 χ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     160 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           · 
                           
                             a 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 k 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           · 
                           
                             b 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 k 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       sk 
                       ?? 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         ?? 
                         , 
                         
                           
                             { 
                             
                               
                                 k 
                                 0 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                               
                                 k 
                                 1 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 k 
                                 L 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                             
                             } 
                           
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             
                                 
                             
                             ⁢ 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             
                                 
                             
                             ⁢ 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               
                                 f 
                                 τ 
                               
                               ; 
                               
                                 ι 
                                 = 
                                 0 
                               
                             
                             , 
                             1 
                           
                         
                       
                       ) 
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The process of the Enc algorithm will be described with reference to  FIG. 10 . 
     The processes of (S 301 ) through (S 302 ) and of (S 304 ) are the same as those in Embodiment 2. 
     (S 303 : Cipher Element Generation Step) 
     With the processing device, an encrypted data generation part  230  generates an element c 0   (τ,κ,ι)  of a ciphertext ct Γ , as indicated in Formula 161. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     ω 
                     , 
                     
                       ζ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           
                             z 
                             0 
                           
                           - 
                           1 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         c 
                         0 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     ω 
                                     , 
                                   
                                   
                                     ︷ 
                                     
                                       n 
                                       0 
                                     
                                   
                                 
                               
                               
                                 
                                   
                                     0 
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     0 
                                     , 
                                   
                                   
                                     ︷ 
                                     
                                       u 
                                       0 
                                     
                                   
                                 
                               
                               
                                 
                                   
                                     0 
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     0 
                                     , 
                                   
                                   
                                     ︷ 
                                     
                                       w 
                                       0 
                                     
                                   
                                 
                               
                               
                                 
                                   
                                     
                                       
                                         φ 
                                         → 
                                       
                                       0 
                                     
                                     , 
                                     ζ 
                                   
                                   
                                     ︷ 
                                     
                                       z 
                                       0 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     161 
                   
                   ] 
                 
               
             
           
         
       
     
     With the processing device, concerning each integer t included in attribute information Γ, the encrypted data generation part  230  generates an element c t   (τ,κ,ι)  of the ciphertext ct Γ , as indicated in Formula 162. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           
                             
                               φ 
                               → 
                             
                             t 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             
                               z 
                               t 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         t 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     
                                       ω 
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     , 
                                   
                                   
                                     ︷ 
                                     
                                       n 
                                       t 
                                     
                                   
                                 
                               
                               
                                 
                                   
                                     0 
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     0 
                                     , 
                                   
                                   
                                     ︷ 
                                     
                                       u 
                                       t 
                                     
                                   
                                 
                               
                               
                                 
                                   
                                     0 
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     0 
                                     , 
                                   
                                   
                                     ︷ 
                                     
                                       w 
                                       t 
                                     
                                   
                                 
                               
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     t 
                                   
                                   
                                     ︷ 
                                     
                                       z 
                                       t 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           t 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     162 
                   
                   ] 
                 
               
             
           
         
       
     
     With the processing device, the encrypted data generation part  230  generates an element c d+1  of the ciphertext ct Γ , as indicated in Formula 163.
 
c d+1 :=g T   ζ msg  [Formula 163]
 
     In brief, from (S 301 ) through (S 303 ), the encryption device  200  generates the ciphertext ct Γ  by executing the Enc algorithm indicated in Formula 164. Then, in (S 304 ), the encryption device  200  transmits the generated ciphertext ct Γ  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       Enc 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           msg 
                           , 
                           
                             Γ 
                             := 
                             
                               { 
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   ) 
                                 
                                 | 
                                 
                                   1 
                                   ≤ 
                                   t 
                                   ≤ 
                                   d 
                                 
                               
                               } 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     ω 
                     , 
                     
                       ζ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           
                             z 
                             0 
                           
                           - 
                           1 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           
                             
                               φ 
                               → 
                             
                             t 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             
                               z 
                               t 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         0 
                         
                           ( 
                           
                             t 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 ω 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     φ 
                                     → 
                                   
                                   0 
                                 
                                 , 
                                 ζ 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         t 
                         
                           ( 
                           
                             t 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   ω 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       x 
                                       → 
                                     
                                     t 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   t 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 t 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   t 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           t 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         
                           d 
                           + 
                           1 
                         
                       
                       := 
                       
                         
                           g 
                           T 
                           ζ 
                         
                         ⁢ 
                         msg 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ct 
                           Γ 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             Γ 
                             , 
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 { 
                                 
                                   c 
                                   t 
                                 
                                 } 
                               
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   ) 
                                 
                                 ∈ 
                                 Γ 
                               
                             
                             , 
                             
                               c 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     164 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, the encryption system  10  according to Embodiment 3 implements a functional encryption scheme in which, as compared to the functional encryption scheme described in Embodiment 2, the number of bases increases but the dimension number of each basis decreases. 
     The KP-FE scheme has been described above. If the KeyGen algorithm and Enc algorithm are modified as indicated in Formulas 165 to 167, the CP-FE scheme may be realized. Note that the Setup algorithm is the same between the KP-FE scheme and the CP-FE scheme. The Dec algorithm is the same as the Dec algorithm indicated in Formula 148. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         KeyGen 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             sk 
                             , 
                             
                               Γ 
                               := 
                               
                                 { 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                   | 
                                   
                                     1 
                                     ≤ 
                                     t 
                                     ≤ 
                                     d 
                                   
                                 
                                 } 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ω 
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             → 
                           
                           0 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           
                             w 
                             0 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 φ 
                                 → 
                               
                               t 
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           k 
                           0 
                           
                             * 
                             
                               ( 
                               
                                 t 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   ω 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     0 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                   1 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             0 
                             
                               * 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           k 
                           t 
                           
                             * 
                             
                               ( 
                               
                                 t 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     ω 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     t 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     t 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             t 
                             
                               * 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             sk 
                             Γ 
                           
                         
                         := 
                         
                           
                             ( 
                             
                               Γ 
                               , 
                               
                                 k 
                                 0 
                                 * 
                               
                               , 
                               
                                 
                                   { 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                   } 
                                 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                   ∈ 
                                   Γ 
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     165 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       Enc 
                       ( 
                       
                         pk 
                         , 
                         msg 
                         , 
                         
                           ?? 
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         x 
                                         ) 
                                       
                                     
                                     
                                       f 
                                       τ 
                                     
                                   
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         π 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     166 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           κ 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       μ 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       deg 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             
                               f 
                               τ 
                             
                             - 
                             κ 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ( 
                     
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         a 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           a 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           a 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         κ 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         b 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             k 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           b 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           
                             f 
                             τ 
                           
                           - 
                           κ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       δ 
                       j 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         j 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           η 
                           → 
                         
                         0 
                       
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         
                           z 
                           0 
                         
                         - 
                         1 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         · 
                         
                           a 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         · 
                         
                           b 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       c 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 ζχ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     167 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           · 
                           
                             a 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 k 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           · 
                           
                             b 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 k 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         t 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     := 
                     
                       
                         g 
                         T 
                         ζ 
                       
                       ⁢ 
                       msg 
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ct 
                       ?? 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         ?? 
                         , 
                         
                           
                             { 
                             
                               
                                 c 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 c 
                                 1 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 c 
                                 L 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             } 
                           
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             
                                 
                             
                             ⁢ 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             
                                 
                             
                             ⁢ 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               
                                 f 
                                 τ 
                               
                               ; 
                               
                                 ι 
                                 = 
                                 0 
                               
                             
                             , 
                             1 
                           
                         
                         , 
                         
                           c 
                           
                             
                               d 
                               + 
                               1 
                             
                             ⁢ 
                             
                                 
                             
                           
                         
                       
                       ) 
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The functional encryption scheme has been described above. If the Setup algorithm, KeyGen algorithm, and Enc algorithm are modified as indicated in Formulas 168 to 171, an attribute-based encryption scheme may be realized. With the attribute-based encryption scheme, in the Setup algorithm, n t  is 2. The Dec algorithm is the same as the Dec algorithm indicated in Formula 153. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           Setup 
                           ⁡ 
                           
                             ( 
                             
                               1 
                               λ 
                             
                             ) 
                           
                         
                         : 
                         
                           
 
                         
                         ⁢ 
                         
                           
                             ( 
                             
                               param 
                               , 
                               
                                 
                                   ( 
                                   
                                     
                                       ?? 
                                       t 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                     , 
                                     
                                       ?? 
                                       t 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                                 
                                   
                                     t 
                                     = 
                                     0 
                                   
                                   , 
                                   
                                       
                                   
                                   ⁢ 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     d 
                                     ; 
                                     
                                       t 
                                       = 
                                       1 
                                     
                                   
                                   , 
                                   
                                       
                                   
                                   ⁢ 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     m 
                                     ; 
                                     
                                       κ 
                                       = 
                                       0 
                                     
                                   
                                   , 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         f 
                                         τ 
                                       
                                     
                                     ; 
                                     
                                       ι 
                                       = 
                                       0.1 
                                     
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ⟵ 
                             R 
                           
                           ⁢ 
                           
                             
                               ?? 
                               ob 
                             
                             ⁡ 
                             
                               ( 
                               
                                 1 
                                 λ 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           τ 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       m 
                       , 
                       
                         κ 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         f 
                         τ 
                       
                       , 
                       
                         ι 
                         = 
                         0 
                       
                       , 
                       1 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   
                                     n 
                                     0 
                                   
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           t 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 2 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   
                                     n 
                                     t 
                                   
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                   + 
                                   
                                     z 
                                     t 
                                   
                                 
                               
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                           
                             * 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           t 
                           
                             * 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 2 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   2 
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   1 
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   2 
                                   + 
                                   
                                     u 
                                     t 
                                   
                                   + 
                                   
                                     w 
                                     t 
                                   
                                 
                               
                               
                                 * 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                           
                           ) 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       d 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           pk 
                         
                         := 
                         
                           ( 
                           
                             
                               1 
                               λ 
                             
                             , 
                             
                               
                                 { 
                                 
                                   
                                     ?? 
                                     ^ 
                                   
                                   t 
                                 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   0 
                                 
                                 , 
                                 
                                     
                                 
                                 ⁢ 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                             
                             , 
                             param 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         := 
                         
                           
                             
                               { 
                               
                                 
                                   ?? 
                                   ^ 
                                 
                                 t 
                                 * 
                               
                               } 
                             
                             
                               
                                 t 
                                 = 
                                 0 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     168 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       KeyGen 
                       ( 
                       
                         pk 
                         , 
                         msg 
                         , 
                         
                           ?? 
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         x 
                                         ) 
                                       
                                     
                                     
                                       f 
                                       τ 
                                     
                                   
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         π 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           π 
                           τ 
                         
                         - 
                         
                           
                             π 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 f 
                                 τ 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         χ 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         χ 
                         m 
                       
                       := 
                       
                         1 
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             χ 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         χ 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         χ 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           χ 
                           τ 
                         
                         - 
                         
                           
                             χ 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 f 
                                 τ 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         τ 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     m 
                     , 
                     
                       κ 
                       = 
                       0 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       f 
                       τ 
                     
                     , 
                     
                       ι 
                       = 
                       0 
                     
                     , 
                     1 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                           ) 
                         
                       
                       := 
                       
                         deg 
                         ⁡ 
                         
                           ( 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             κ 
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
                         μ 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             1 
                           
                           ) 
                         
                       
                       := 
                       
                         deg 
                         ⁡ 
                         
                           ( 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             
                               
                                 f 
                                 τ 
                               
                               - 
                               κ 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ( 
                       
                         
                           κ 
                           = 
                           0 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           f 
                           τ 
                         
                       
                       ) 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           a 
                           
                             i 
                             , 
                             0 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         + 
                         
                           
                             a 
                             
                               i 
                               , 
                               1 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                           ⁢ 
                           x 
                         
                         + 
                         … 
                         + 
                         
                           
                             a 
                             
                               i 
                               , 
                               
                                 
                                   μ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                                 - 
                                 1 
                               
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                               
                               ) 
                             
                           
                           ⁢ 
                           
                             x 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                         
                       
                       := 
                       
                         
                           
                             a 
                             i 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         ⁢ 
                         mod 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           κ 
                         
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     169 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         b 
                         
                           i 
                           , 
                           0 
                         
                         
                           ( 
                           
                             τ 
                             , 
                             k 
                           
                           ) 
                         
                       
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             1 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         x 
                       
                       + 
                       … 
                       + 
                       
                         
                           b 
                           
                             i 
                             , 
                             
                               
                                 μ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               - 
                               1 
                             
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           x 
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                       
                     
                     := 
                     
                       
                         
                           b 
                           i 
                         
                         ⁡ 
                         
                           ( 
                           x 
                           ) 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             d 
                             τ 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           
                             f 
                             τ 
                           
                           - 
                           κ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       δ 
                       j 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         j 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           μ 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           η 
                           → 
                         
                         0 
                       
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                         · 
                         
                           a 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           0 
                         
                         
                           
                             μ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         
                           δ 
                           j 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                         · 
                         
                           b 
                           
                             0 
                             , 
                             j 
                           
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       0 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   0 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   π 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                               
                                 χ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     170 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                               ) 
                             
                           
                           · 
                           
                             a 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 k 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             0 
                           
                           
                             
                               μ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             δ 
                             j 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                           · 
                           
                             b 
                             
                               i 
                               , 
                               j 
                             
                             
                               ( 
                               
                                 τ 
                                 , 
                                 k 
                               
                               ) 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           v 
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     v 
                                     i 
                                   
                                 
                               
                               , 
                               
                                 - 
                                 
                                   θ 
                                   i 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             v 
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     s 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     v 
                                     i 
                                   
                                 
                                 - 
                                 
                                   s 
                                   i 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       p 
                       0 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 s 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         ?? 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           ?? 
                           , 
                           
                             
                               { 
                               
                                 
                                   k 
                                   0 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 , 
                                 
                                   k 
                                   1 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   k 
                                   L 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   f 
                                   τ 
                                 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Enc 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             msg 
                             , 
                             
                               Γ 
                               := 
                               
                                 { 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         x 
                                         t 
                                       
                                     
                                     ) 
                                   
                                   | 
                                   
                                     1 
                                     ≤ 
                                     t 
                                     ≤ 
                                     d 
                                   
                                 
                                 } 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ω 
                       , 
                       
                         ζ 
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             → 
                           
                           0 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           
                             
                               z 
                               0 
                             
                             - 
                             1 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 φ 
                                 → 
                               
                               t 
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                               
                                 z 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           0 
                           
                             ( 
                             
                               t 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   ω 
                                   , 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     0 
                                   
                                   , 
                                   ζ 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             0 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                       
                       , 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     171 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       c 
                       t 
                       
                         ( 
                         
                           t 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 ω 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     1 
                                     , 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       x 
                                       t 
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 φ 
                                 → 
                               
                               t 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             x 
                             t 
                           
                         
                         ) 
                       
                     
                     ∈ 
                     Γ 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     := 
                     
                       
                         g 
                         T 
                         ζ 
                       
                       ⁢ 
                       msg 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ct 
                         Γ 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           Γ 
                           , 
                           
                             c 
                             0 
                           
                           , 
                           
                             
                               { 
                               
                                 c 
                                 t 
                               
                               } 
                             
                             
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     x 
                                     t 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               Γ 
                             
                           
                           , 
                           
                             c 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     Likewise, the CP-FE scheme indicated in Formulas 165 to 167 can be altered to the attribute-based encryption scheme. 
     In the above explanation, n 0 +u 0 +w 0 +z 0  is set in N 0  and n t +u t +w t +z t  is set in N t . If, for example, u 0 =n 0 , w 0 =n 0 , and z 0 =2, then n 0 +n 0 +n 0 +2=3n 0 +2 (n 0 =1 and accordingly N 0 =5) may be set in N 0 . If u t =n t , w t =n t , and z t =1, then n t +n t +n t +1=3n t +1 may be set in N t . 
     Embodiment 4. 
     In Embodiments 2 and 3, for each polynomial d τ (x) fτ  obtained by factorizing the target polynomial d(x), an element which is a remainder of dividing a polynomial a i (x) by a polynomial d τ (x) κ  and an element which is a remainder of dividing a polynomial b i (x) by a polynomial d τ (x) fτ-κ  are treated as key elements. 
     In Embodiment 4, for each polynomial d τ (x) fτ  obtained by factorizing the target polynomial d(x), an element obtained by substituting a random value γ into a polynomial d τ (x) κ  and an element obtained by substituting the random value γ into a polynomial d τ (x) fτ-κ  are treated as key elements. 
     The configurations of a key generation device  100 , an encryption device  200 , and a decryption device  300  according to Embodiment 4 are respectively the same as the configurations of the key generation device  100 , the encryption device  200 , and the decryption device  300  according to Embodiment 2 shown in  FIGS. 5 and 7 . 
     The processes of a Setup algorithm and Enc algorithm according to Embodiment 4 are the same as the processes of the Setup algorithm and Enc algorithm according to Embodiment 2. 
     The process flow of the Dec algorithm according to Embodiment 4 is the same as the process flow of the Dec algorithm according to Embodiment 2 shown in  FIG. 11 . 
       FIG. 12  is a flowchart showing the process of the KeyGen algorithm according to Embodiment 4. 
     The process of the KeyGen algorithm will be described with reference to  FIG. 12 . 
     The processes of (S 501 ) through (S 503 ) are the same as the processes of (S 201 ) to (S 203 ) shown in  FIG. 9 , and the process of (S 505 ) is the same as the process of (S 206 ) shown in  FIG. 9 . 
     (S 504 : Key Element Generation Step) 
     With the processing device, concerning each integer τ of τ=1 . . . , m, each integer κ of κ=0, f each integer ι of ι=0, 1, and each integer j of j=1, . . . , μ+1, a key element generation part  142  generates elements k* 0,j   (τ,κ,ι)  and k* 0,μ+1   (τ,κ,ι)  of a decryption key sk s , as indicated in Formula 172. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       γ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         η 
                         → 
                       
                       
                         0 
                         , 
                         0 
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         
                           0 
                           , 
                           
                             μ 
                             + 
                             1 
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         
                           0 
                           , 
                           j 
                         
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                             ) 
                           
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   δ 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           γ 
                                           j 
                                         
                                         · 
                                         
                                           
                                             
                                               d 
                                               τ 
                                             
                                             ⁡ 
                                             
                                               ( 
                                               γ 
                                               ) 
                                             
                                           
                                           κ 
                                         
                                       
                                       , 
                                       
                                         
                                           ⅇ 
                                           → 
                                         
                                         
                                           0 
                                           , 
                                           j 
                                         
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   
                                     0 
                                     , 
                                     j 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   0 
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         
                           0 
                           , 
                           j 
                         
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   δ 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           γ 
                                           j 
                                         
                                         · 
                                         
                                           
                                             
                                               d 
                                               τ 
                                             
                                             ⁡ 
                                             
                                               ( 
                                               γ 
                                               ) 
                                             
                                           
                                           
                                             
                                               f 
                                               τ 
                                             
                                             - 
                                             κ 
                                           
                                         
                                       
                                       , 
                                       
                                         
                                           ⅇ 
                                           → 
                                         
                                         
                                           0 
                                           , 
                                           j 
                                         
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             1 
                                           
                                           ) 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   
                                     0 
                                     , 
                                     j 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   0 
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         s 
                         0 
                       
                       := 
                       
                         
                           
                             - 
                             
                               
                                 a 
                                 0 
                               
                               ⁡ 
                               
                                 ( 
                                 γ 
                                 ) 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ι 
                         
                         = 
                         0 
                       
                     
                     , 
                     
                       
                         s 
                         0 
                       
                       := 
                       
                         
                           
                             - 
                             
                               
                                 b 
                                 0 
                               
                               ⁡ 
                               
                                 ( 
                                 γ 
                                 ) 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ι 
                         
                         = 
                         1 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         
                           0 
                           , 
                           
                             μ 
                             + 
                             1 
                           
                         
                         
                           * 
                           
                             ( 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   δ 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           s 
                                           0 
                                         
                                         + 
                                         
                                           π 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                         
                                       
                                       , 
                                       
                                         
                                           ⅇ 
                                           → 
                                         
                                         
                                           0 
                                           , 
                                           
                                             μ 
                                             + 
                                             1 
                                           
                                         
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 0 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   
                                     0 
                                     , 
                                     
                                       μ 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 , 
                                 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   0 
                                 
                                 , 
                                 
                                   χ 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ?? 
                           0 
                           * 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     172 
                   
                   ] 
                 
               
             
           
         
       
     
     With the processing device, concerning each integer τ of τ=1 . . . , m, each integer κ of κ=0, . . . , f τ , each integer ι of ι=0, 1, and each integer i of i=1, . . . , L, the key element generation part  142  generates an element k* i   (τ,κ,ι)  of the decryption key sk as indicated in Formula 173. 
     
       
         
           
             
               
                 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               a 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         + 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               0 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ι 
                         
                       
                       = 
                       0 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               b 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         + 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ι 
                         
                       
                       = 
                       1 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         s 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           → 
                                         
                                         1 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   s 
                                   i 
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     173 
                   
                   ] 
                 
               
             
           
         
       
     
     Note that e →   0,j   (τ,κ,ι)  (j=1, . . . , μ+1) is a 2mf max -dimensional vector in which 1 is set as the coefficient for one basis vector and 0 is set as the coefficient for another basis vector, and the basis vector for which 1 is set as the coefficient is different for each (τ,κ,ι). 
     In brief, from (S 501 ) through (S 504 ), the key generation device  100  generates the decryption key sk s  by executing the KeyGen algorithm indicated in Formulas 174 to 175. Then, in (S 505 ), the key generation device  100  distributes the generated decryption key sk s  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       KeyGen 
                       ( 
                       
                         pk 
                         , 
                         sk 
                         , 
                         
                           ?? 
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         x 
                                         ) 
                                       
                                     
                                     
                                       f 
                                       τ 
                                     
                                   
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         π 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     174 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     γ 
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       η 
                       → 
                     
                     
                       0 
                       , 
                       0 
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       
                         0 
                         , 
                         
                           μ 
                           + 
                           1 
                         
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       j 
                     
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   μ 
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       
                         0 
                         , 
                         j 
                       
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         κ 
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       
                                         0 
                                         , 
                                         j 
                                       
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   j 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       
                         0 
                         , 
                         j 
                       
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             1 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         
                                           
                                             f 
                                             τ 
                                           
                                           - 
                                           κ 
                                         
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       
                                         0 
                                         , 
                                         j 
                                       
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   j 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       0 
                     
                   
                   , 
                   
                     
                       s 
                       0 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               b 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       1 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       
                         0 
                         , 
                         
                           μ 
                           + 
                           1 
                         
                       
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         x 
                                         0 
                                       
                                       + 
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       
                                         0 
                                         , 
                                         
                                           μ 
                                           + 
                                           1 
                                         
                                       
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 0 
                               
                               , 
                               
                                 χ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       
                         ?? 
                         q 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             i 
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             L 
                             ; 
                             
                               τ 
                               = 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             
                               m 
                               - 
                               1 
                             
                             ; 
                             
                               ι 
                               = 
                               0 
                             
                           
                           , 
                           1 
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ξ 
                       
                         i 
                         , 
                         m 
                         , 
                         ι 
                       
                     
                     := 
                     
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 i 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 L 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                             ) 
                           
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               a 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         + 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               0 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ι 
                         
                       
                       = 
                       0 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       i 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               b 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         + 
                         
                           
                             ξ 
                             
                               i 
                               , 
                               τ 
                               , 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ι 
                         
                       
                       = 
                       1 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     175 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         s 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           → 
                                         
                                         1 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   s 
                                   i 
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         ?? 
                       
                     
                     := 
                     
                       ( 
                       
                         ?? 
                         , 
                         
                           
                             { 
                             
                               
                                 k 
                                 
                                   0 
                                   , 
                                   0 
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 k 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                               
                                 k 
                                 1 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                     
                                   
                                     k 
                                     L 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   } 
                                 
                                 
                                   
                                     τ 
                                     = 
                                     1 
                                   
                                   , 
                                   
                                       
                                   
                                   ⁢ 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     m 
                                     ; 
                                     
                                       κ 
                                       = 
                                       0 
                                     
                                   
                                   , 
                                   
                                       
                                   
                                   ⁢ 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     
                                       f 
                                       τ 
                                     
                                     ; 
                                     
                                       ι 
                                       = 
                                       0 
                                     
                                   
                                   , 
                                   1 
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The process of the Dec algorithm will be described with reference to  FIG. 11 . 
     The processes of (S 401 ) through (S 404 ) are the same as those in Embodiment 2. 
     (S 405 : Coefficient Calculation Step) 
     With the processing device, a coefficient calculation part  332  of a complementary coefficient calculation part  330  calculates coefficients (α 1 , . . . , α L ), coefficients (β i , . . . , β L ), and a degree x with which Formula 176 is established.
 
 h   τ,κ,0 ( x )· d   τ ( x ) κ   =a   0 ( x )+Σ i=1   L α i   a   i ( x ), and
 
 h   τ,κ,1 ( x )· d   τ ( x ) ƒ     τ     -κ   =b   0 ( x )+Σ i=1   L β i   b   i ( x )  [Formula 176]
 
     Note that α i =0=β i  concerning all i not included in I (ρ,Γ) . Also, h τ,κ,ι (x):=h τ,κ,ι,0 +h τ,κ,ι,1 x+ . . . h τ,κ,ι,μ x μ  concerning all integers τ of τ=1, . . ., m and all integers ι of ι=0, 1. 
     (S 406 : Pairing Operation Step) 
     A pairing operation part  341  of a decryption part  340  generates session keys K τ,0  and K τ,1  by calculating Formula 177 with the processing device. 
     
       
         
           
             
               
                 
                   
                     
                       
                         
                           K 
                           
                             τ 
                             , 
                             0 
                           
                         
                         := 
                         
                           
                             e 
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 
                                   ∑ 
                                   
                                     j 
                                     = 
                                     0 
                                   
                                   μ 
                                 
                                 ⁢ 
                                 
                                   
                                     h 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                       , 
                                       j 
                                     
                                   
                                   ⁢ 
                                   
                                     k 
                                     
                                       0 
                                       , 
                                       j 
                                     
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                               
                             
                             ) 
                           
                           · 
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   c 
                                   0 
                                 
                                 , 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     
                                       μ 
                                       + 
                                       1 
                                     
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                 
                               
                               ) 
                             
                           
                           · 
                           
                             
                               ∏ 
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     δ 
                                   
                                 
                                 , 
                                 + 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       t 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   α 
                                   i 
                                 
                                 · 
                                 
                                   
                                     ∏ 
                                     
                                       
                                         i 
                                         ∈ 
                                         
                                           I 
                                           δ 
                                         
                                       
                                       , 
                                       - 
                                     
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             c 
                                             t 
                                           
                                           , 
                                           
                                             k 
                                             i 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   κ 
                                                   , 
                                                   0 
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                     ⁢ 
                                     
                                       
                                         α 
                                         i 
                                       
                                       / 
                                       
                                         ( 
                                         
                                           
                                             
                                               v 
                                               → 
                                             
                                             i 
                                           
                                           · 
                                           
                                             
                                               x 
                                               → 
                                             
                                             t 
                                           
                                         
                                         ) 
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           K 
                           
                             τ 
                             , 
                             1 
                           
                         
                         := 
                         
                           
                             e 
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 
                                   ∑ 
                                   
                                     j 
                                     = 
                                     0 
                                   
                                   μ 
                                 
                                 ⁢ 
                                 
                                   
                                     h 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       1 
                                       , 
                                       j 
                                     
                                   
                                   ⁢ 
                                   
                                     k 
                                     
                                       0 
                                       , 
                                       j 
                                     
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                               
                             
                             ) 
                           
                           · 
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   c 
                                   0 
                                 
                                 , 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     
                                       μ 
                                       + 
                                       1 
                                     
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                 
                               
                               ) 
                             
                           
                           · 
                           
                             
                               ∏ 
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     δ 
                                   
                                 
                                 , 
                                 + 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       t 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             1 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   β 
                                   i 
                                 
                                 · 
                                 
                                   
                                     ∏ 
                                     
                                       
                                         i 
                                         ∈ 
                                         
                                           I 
                                           δ 
                                         
                                       
                                       , 
                                       - 
                                     
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             c 
                                             t 
                                           
                                           , 
                                           
                                             k 
                                             i 
                                             
                                               * 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   κ 
                                                   , 
                                                   1 
                                                 
                                                 ) 
                                               
                                             
                                           
                                         
                                         ) 
                                       
                                     
                                     ⁢ 
                                     
                                       
                                         β 
                                         i 
                                       
                                       / 
                                       
                                         ( 
                                         
                                           
                                             
                                               v 
                                               → 
                                             
                                             i 
                                           
                                           · 
                                           
                                             
                                               x 
                                               → 
                                             
                                             t 
                                           
                                         
                                         ) 
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           where 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             I 
                             
                               δ 
                               , 
                               + 
                             
                           
                         
                         := 
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     δ 
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                                 ) 
                               
                             
                             } 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           and 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         I 
                         
                           δ 
                           , 
                           - 
                         
                       
                       := 
                       
                         { 
                         
                           
                             
                               i 
                               ∈ 
                               
                                 I 
                                 δ 
                               
                             
                             | 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                           = 
                           
                             ⫬ 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               ) 
                             
                           
                         
                         } 
                       
                     
                   
                   ⁢ 
                   
                       
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     177 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 407 : Message Calculation Step) 
     A message calculation part  342  generates a message msg′ (=msg) by calculating Formula 178 with the processing device. 
     
       
         
           
             
               
                 
                   
                     msg 
                     ′ 
                   
                   := 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     / 
                     
                       ( 
                       
                         
                           ∏ 
                           
                             τ 
                             = 
                             1 
                           
                           m 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             K 
                             
                               τ 
                               , 
                               0 
                             
                           
                           ⁢ 
                           
                             K 
                             
                               τ 
                               , 
                               1 
                             
                           
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     178 
                   
                   ] 
                 
               
             
           
         
       
     
     Note that by calculating Formula 177, g T   ζ  can be obtained, as indicated in Formula 179. Hence, by calculating Formula 178, the message msg′ (=msg) m can be obtained. 
     
       
         
           
             
               
                 
                   
                     
                       K 
                       
                         τ 
                         , 
                         0 
                       
                     
                     := 
                     
                       
                         
                           e 
                           ( 
                           
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       t 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       
                                         * 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             0 
                                           
                                           ) 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                               
                                 α 
                                 i 
                               
                             
                             · 
                             
                               
                                 ∏ 
                                 
                                   
                                     i 
                                     ∈ 
                                     
                                       I 
                                       δ 
                                     
                                   
                                   , 
                                   - 
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   e 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         c 
                                         t 
                                       
                                       , 
                                       
                                         k 
                                         i 
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               0 
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     α 
                                     i 
                                   
                                   / 
                                   
                                     ( 
                                     
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                       · 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                 
                               
                             
                           
                         
                       
                       = 
                       
                         
                           
                             g 
                             T 
                             
                               δω 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     ∑ 
                                     
                                       j 
                                       = 
                                       0 
                                     
                                     μ 
                                   
                                   ⁢ 
                                   
                                     
                                       h 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                         , 
                                         j 
                                       
                                     
                                     ⁢ 
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         κ 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                           
                           · 
                           
                             g 
                             T 
                             
                               
                                 δω 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       - 
                                       
                                         
                                           a 
                                           0 
                                         
                                         ⁡ 
                                         
                                           ( 
                                           γ 
                                           ) 
                                         
                                       
                                     
                                     + 
                                     
                                       π 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               + 
                               
                                 ζχ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                               
                             
                           
                           · 
                           
                             g 
                             T 
                             
                               δω 
                               ⁢ 
                               
                                 
                                   ∑ 
                                   
                                     i 
                                     = 
                                     1 
                                   
                                   L 
                                 
                                 ⁢ 
                                 
                                   ( 
                                   
                                     
                                       
                                         - 
                                         
                                           α 
                                           i 
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           α 
                                           i 
                                         
                                         ⁡ 
                                         
                                           ( 
                                           γ 
                                           ) 
                                         
                                       
                                     
                                     + 
                                     
                                       
                                         α 
                                         i 
                                       
                                       ⁢ 
                                       
                                         ξ 
                                         
                                           i 
                                           , 
                                           τ 
                                           , 
                                           0 
                                         
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                           
                         
                         = 
                         
                           
                             
                               g 
                               T 
                               
                                 δω 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     
                                       h 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                     
                                     ⁡ 
                                     
                                       ( 
                                       γ 
                                       ) 
                                     
                                   
                                   · 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         γ 
                                         ) 
                                       
                                     
                                     κ 
                                   
                                 
                               
                             
                             · 
                             
                               g 
                               T 
                               
                                 - 
                                 
                                   δω 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           a 
                                           0 
                                         
                                         ⁡ 
                                         
                                           ( 
                                           γ 
                                           ) 
                                         
                                       
                                       + 
                                       
                                         
                                           ∑ 
                                           
                                             i 
                                             = 
                                             1 
                                           
                                           L 
                                         
                                         ⁢ 
                                         
                                           
                                             α 
                                             i 
                                           
                                           ⁢ 
                                           
                                             
                                               α 
                                               i 
                                             
                                             ⁡ 
                                             
                                               ( 
                                               γ 
                                               ) 
                                             
                                           
                                         
                                       
                                     
                                     ) 
                                   
                                 
                               
                             
                             · 
                             
                               g 
                               T 
                               
                                 
                                   δωπ 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                 
                                 + 
                                 
                                   ζχ 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                 
                                 + 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     L 
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     ⁢ 
                                     
                                       ξ 
                                       
                                         i 
                                         , 
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                   
                                 
                               
                             
                           
                           = 
                           
                             g 
                             T 
                             
                               
                                 δωπ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                               
                               + 
                               
                                 ζχ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   0 
                                 
                               
                               + 
                               
                                 
                                   ∑ 
                                   
                                     i 
                                     = 
                                     1 
                                   
                                   L 
                                 
                                 ⁢ 
                                 
                                   
                                     α 
                                     i 
                                   
                                   ⁢ 
                                   
                                     ξ 
                                     
                                       i 
                                       , 
                                       τ 
                                       , 
                                       0 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       K 
                       
                         τ 
                         , 
                         1 
                       
                     
                     = 
                     
                       
                         
                           g 
                           T 
                           
                             
                               δωπ 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                             
                             + 
                             
                               ζχ 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                             
                             + 
                             
                               
                                 ∑ 
                                 
                                   i 
                                   = 
                                   1 
                                 
                                 L 
                               
                               ⁢ 
                               
                                 
                                   β 
                                   i 
                                 
                                 ⁢ 
                                 
                                   ξ 
                                   
                                     i 
                                     , 
                                     τ 
                                     , 
                                     1 
                                   
                                 
                               
                             
                           
                         
                         ⁢ 
                         
                           
 
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               τ 
                               = 
                               1 
                             
                             m 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               K 
                               
                                 τ 
                                 , 
                                 0 
                               
                             
                             ⁢ 
                             
                               K 
                               
                                 τ 
                                 , 
                                 1 
                               
                             
                           
                         
                       
                       = 
                       
                         
                           g 
                           T 
                           
                             
                               ∑ 
                               
                                 τ 
                                 = 
                                 1 
                               
                               m 
                             
                             ⁢ 
                             
                               ( 
                               
                                 
                                   δω 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                       
                                       + 
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   ζ 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         χ 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                       
                                       + 
                                       
                                         χ 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 + 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     L 
                                   
                                   ⁢ 
                                   
                                     ( 
                                     
                                       
                                         
                                           α 
                                           i 
                                         
                                         ⁢ 
                                         
                                           ξ 
                                           
                                             i 
                                             , 
                                             τ 
                                             , 
                                             0 
                                           
                                         
                                       
                                       + 
                                       
                                         
                                           β 
                                           i 
                                         
                                         ⁢ 
                                         
                                           ξ 
                                           
                                             i 
                                             , 
                                             τ 
                                             , 
                                             1 
                                           
                                         
                                       
                                     
                                     ) 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         = 
                         
                           
                             g 
                             T 
                             
                               
                                 ω 
                                 ⁢ 
                                 
                                   
                                     ∑ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                     π 
                                     τ 
                                   
                                 
                               
                               + 
                               
                                 ζ 
                                 ⁢ 
                                 
                                   
                                     ∑ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                     χ 
                                     τ 
                                   
                                 
                               
                               + 
                               
                                 ω 
                                 ⁢ 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     L 
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           ∑ 
                                           
                                             τ 
                                             = 
                                             1 
                                           
                                           m 
                                         
                                         ⁢ 
                                         
                                           ξ 
                                           
                                             i 
                                             , 
                                             τ 
                                             , 
                                             0 
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                               + 
                               
                                 ω 
                                 ⁢ 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     L 
                                   
                                   ⁢ 
                                   
                                     
                                       β 
                                       i 
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           ∑ 
                                           
                                             τ 
                                             = 
                                             1 
                                           
                                           m 
                                         
                                         ⁢ 
                                         
                                           ξ 
                                           
                                             i 
                                             , 
                                             τ 
                                             , 
                                             1 
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                           = 
                           
                             g 
                             T 
                             ζ 
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     179 
                   
                   ] 
                 
               
             
           
         
       
     
     In brief, from (S 401 ) through (S 407 ), the decryption device  300  generates the message msg′ (=msg) by executing the Dec algorithm indicated in Formula 180. 
     
       
         
           
             
               
                 
                   Dec 
                   ( 
                   
                     pk 
                     , 
                     
                       
                         sk 
                         ?? 
                       
                       := 
                       
                         
                           
                               
                             
                               
                                 ( 
                                 
                                   ?? 
                                   , 
                                   
                                     
                                       { 
                                       
                                         
                                           k 
                                           
                                             0 
                                             , 
                                             0 
                                           
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                         , 
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         , 
                                         
                                           k 
                                           
                                             0 
                                             , 
                                             
                                               μ 
                                               + 
                                               1 
                                             
                                           
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                         , 
                                         
                                           k 
                                           1 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                         , 
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         , 
                                         
                                           k 
                                           L 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       } 
                                     
                                     
                                       
                                         τ 
                                         = 
                                         1 
                                       
                                       , 
                                       
                                           
                                       
                                       ⁢ 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         m 
                                         ; 
                                         
                                           κ 
                                           = 
                                           0 
                                         
                                       
                                       , 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         
                                           … 
                                           ⁢ 
                                           
                                               
                                           
                                           ⁢ 
                                           
                                             f 
                                             τ 
                                           
                                         
                                         ; 
                                         
                                           ι 
                                           = 
                                           0 
                                         
                                       
                                       , 
                                       1 
                                     
                                   
                                 
                                 ) 
                               
                               , 
                               
                                 
 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   ct 
                                   Γ 
                                 
                                 := 
                                 
                                   ( 
                                   
                                     Γ 
                                     , 
                                     
                                       c 
                                       0 
                                     
                                     , 
                                     
                                       
                                         { 
                                         
                                           c 
                                           t 
                                         
                                         } 
                                       
                                       
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               t 
                                             
                                           
                                           ) 
                                         
                                         ∈ 
                                         Γ 
                                       
                                     
                                     , 
                                     
                                       c 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                           : 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ?? 
                           
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 ?? 
                                 , 
                                 ℬ 
                                 , 
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 , 
                                 ρ 
                               
                               ) 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             accepts 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             Γ 
                           
                           := 
                           
                             { 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     x 
                                     → 
                                   
                                   t 
                                 
                               
                               ) 
                             
                             } 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         then 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         compute 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           I 
                           δ 
                         
                       
                       ⊆ 
                       
                         { 
                         
                           1 
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                         
                         } 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           α 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           α 
                           L 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         
                           ( 
                           
                             
                               β 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               β 
                               L 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                         ⁢ 
                         
                           
 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           κ 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           with 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                       
                       := 
                       
                         
                           h 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                             , 
                             0 
                           
                         
                         + 
                         
                           
                             h 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                               , 
                               1 
                             
                           
                           ⁢ 
                           x 
                         
                         + 
                         … 
                         + 
                         
                           
                             h 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                               , 
                               μ 
                             
                           
                           ⁢ 
                           
                             x 
                             μ 
                           
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               for 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               all 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               τ 
                             
                             = 
                             1 
                           
                         
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         m 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       0 
                     
                     , 
                     
                       1 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       such 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           · 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             κ 
                           
                         
                         = 
                         
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   a 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       and 
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 h 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   1 
                                 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             · 
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                           
                           ⁢ 
                           
                             f 
                             τ 
                             
                               - 
                               κ 
                             
                           
                         
                         = 
                         
                           
                             
                               b 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   b 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           e 
                           ( 
                           
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     t 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     , 
                                     - 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     / 
                                     
                                       ( 
                                       
                                         
                                           
                                             v 
                                             → 
                                           
                                           i 
                                         
                                         · 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           e 
                           ( 
                           
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     t 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     , 
                                     - 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 1 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       β 
                                       i 
                                     
                                     / 
                                     
                                       ( 
                                       
                                         
                                           
                                             v 
                                             → 
                                           
                                           i 
                                         
                                         · 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           I 
                           
                             δ 
                             , 
                             + 
                           
                         
                       
                       := 
                       
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     δ 
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                                 ) 
                               
                             
                             } 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           and 
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             I 
                             
                               δ 
                               , 
                               - 
                             
                           
                         
                         := 
                         
                           
                             
                               
                                 { 
                                 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     | 
                                     
                                       ρ 
                                       ⁡ 
                                       
                                         ( 
                                         i 
                                         ) 
                                       
                                     
                                   
                                   = 
                                   
                                     ⫬ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           
                                             v 
                                             → 
                                           
                                           i 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                                 } 
                               
                               . 
                               
                                   
                               
                               ⁢ 
                               
                                 
 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               return 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               msg 
                               ′ 
                             
                           
                           := 
                           
                             
                               c 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                             / 
                             
                               
                                 ( 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       K 
                                       
                                         τ 
                                         , 
                                         0 
                                       
                                     
                                     ⁢ 
                                     
                                       K 
                                       
                                         τ 
                                         , 
                                         1 
                                       
                                     
                                   
                                 
                                 ) 
                               
                               . 
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     180 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, a cryptographic system  10  according to Embodiment 4 implements the functional encryption scheme by treating the element obtained by substituting the random value γ into the polynomial d τ (x) κ  and the element obtained by substituting the random value γ into the polynomial d τ (x) fτ-κ , as key elements. 
     The KP-FE scheme has been described above. If the KeyGen algorithm, Enc algorithm, and Dec algorithm are modified as indicated in Formulas 181 to 184, the CP-FE scheme may be realized. Note that the Setup algorithm is the same between the KP-FE scheme and the CP-FE scheme. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         KeyGen 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             sk 
                             , 
                             
                               Γ 
                               := 
                               
                                 { 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                   | 
                                   
                                     1 
                                     ≤ 
                                     t 
                                     ≤ 
                                     d 
                                   
                                 
                                 } 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ω 
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             → 
                           
                           0 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           
                             w 
                             0 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 φ 
                                 → 
                               
                               t 
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           k 
                           0 
                           * 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   ω 
                                   , 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     0 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                   1 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             0 
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           k 
                           t 
                           * 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     ω 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   , 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                 
                                 
                                   ︷ 
                                   
                                     n 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     t 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     t 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   0 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   0 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     t 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ?? 
                             t 
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             sk 
                             Γ 
                           
                         
                         := 
                         
                           
                             ( 
                             
                               Γ 
                               , 
                               
                                 k 
                                 0 
                                 * 
                               
                               , 
                               
                                 
                                   { 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                   } 
                                 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                   ∈ 
                                   Γ 
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     181 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       Enc 
                       ( 
                       
                         pk 
                         , 
                         msg 
                         , 
                         
                           ?? 
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         x 
                                         ) 
                                       
                                     
                                     
                                       f 
                                       τ 
                                     
                                   
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         π 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     182 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           π 
                           τ 
                         
                         - 
                         
                           
                             π 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 f 
                                 τ 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         χ 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         χ 
                         m 
                       
                       := 
                       
                         1 
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             χ 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         χ 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         χ 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           χ 
                           τ 
                         
                         - 
                         
                           
                             χ 
                             
                               τ 
                               , 
                               κ 
                               , 
                               0 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 f 
                                 τ 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         τ 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     m 
                     , 
                     
                       κ 
                       = 
                       0 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       f 
                       τ 
                     
                     , 
                     
                       ι 
                       = 
                       0 
                     
                     , 
                     1 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       γ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         η 
                         → 
                       
                       
                         0 
                         , 
                         0 
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         
                           0 
                           , 
                           μ 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           z 
                           0 
                         
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         
                           0 
                           , 
                           
                             μ 
                             + 
                             I 
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           
                             z 
                             0 
                           
                           - 
                           1 
                         
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         j 
                       
                       = 
                       0 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     μ 
                     , 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       c 
                       
                         0 
                         , 
                         j 
                       
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         κ 
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               
                                 0 
                                 , 
                                 j 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       
                         0 
                         , 
                         j 
                       
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           1 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         
                                           
                                             f 
                                             τ 
                                           
                                           - 
                                           κ 
                                         
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               
                                 0 
                                 , 
                                 j 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       0 
                     
                   
                   , 
                   
                     
                       s 
                       0 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               b 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       1 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       
                         0 
                         , 
                         
                           μ 
                           + 
                           1 
                         
                       
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         s 
                                         0 
                                       
                                       + 
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 0 
                               
                               , 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                               
                               , 
                               
                                 ζχ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           ι 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         
                           ?? 
                           q 
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               i 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               L 
                               ; 
                               
                                 τ 
                                 = 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               
                                 m 
                                 - 
                                 1 
                               
                               ; 
                               
                                 ι 
                                 = 
                                 0 
                               
                             
                             , 
                             1 
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ξ 
                         
                           i 
                           , 
                           m 
                           , 
                           ι 
                         
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             
                               ξ 
                               
                                 i 
                                 , 
                                 τ 
                                 , 
                                 ι 
                               
                             
                             ⁡ 
                             
                               ( 
                               
                                 
                                   i 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   L 
                                   ; 
                                   
                                     ι 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         s 
                         i 
                       
                       := 
                       
                         
                           
                             - 
                             
                               
                                 a 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 γ 
                                 ) 
                               
                             
                           
                           + 
                           
                             
                               ξ 
                               
                                 i 
                                 , 
                                 τ 
                                 , 
                                 0 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ι 
                           
                         
                         = 
                         0 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         s 
                         i 
                       
                       := 
                       
                         
                           
                             - 
                             
                               
                                 b 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 γ 
                                 ) 
                               
                             
                           
                           + 
                           
                             
                               ξ 
                               
                                 i 
                                 , 
                                 τ 
                                 , 
                                 1 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ι 
                           
                         
                         = 
                         1 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
                         θ 
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           z 
                           t 
                         
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     183 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         s 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           → 
                                         
                                         1 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         z 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                       
                         ( 
                         
                           τ 
                           , 
                           κ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   s 
                                   i 
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                               
                                 
                                   e 
                                   → 
                                 
                                 i 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 0 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     := 
                     
                       
                         g 
                         T 
                         ζ 
                       
                       ⁢ 
                       msg 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ct 
                         ?? 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           ?? 
                           , 
                           
                             
                               { 
                               
                                 
                                   c 
                                   
                                     0 
                                     , 
                                     0 
                                   
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   c 
                                   
                                     0 
                                     , 
                                     
                                       μ 
                                       + 
                                       1 
                                     
                                   
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   c 
                                   1 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   c 
                                   L 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   f 
                                   τ 
                                 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                           
                           , 
                           
                             c 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         Dec 
                         ( 
                         
                           pk 
                           , 
                           
                             
                               ct 
                               ?? 
                             
                             := 
                             
                               ( 
                               
                                 ?? 
                                 , 
                                 
                                   
                                     { 
                                     
                                       
                                         c 
                                         
                                           0 
                                           , 
                                           0 
                                         
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         c 
                                         
                                           0 
                                           , 
                                           
                                             μ 
                                             + 
                                             1 
                                           
                                         
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                       
                                       , 
                                       
                                         c 
                                         1 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         c 
                                         L 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             κ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                       
                                     
                                     } 
                                   
                                   
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     , 
                                     
                                         
                                     
                                     ⁢ 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       m 
                                       ; 
                                       
                                         κ 
                                         = 
                                         0 
                                       
                                     
                                     , 
                                     
                                         
                                     
                                     ⁢ 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       
                                         f 
                                         τ 
                                       
                                       ; 
                                       
                                         ι 
                                         = 
                                         0 
                                       
                                     
                                     , 
                                     1 
                                   
                                 
                                 , 
                                 
                                   c 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               sk 
                               Γ 
                             
                             := 
                             
                               ( 
                               
                                 Γ 
                                 , 
                                 
                                   k 
                                   0 
                                   * 
                                 
                                 , 
                                 
                                   
                                     { 
                                     
                                       k 
                                       t 
                                       * 
                                     
                                     } 
                                   
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                     ∈ 
                                     Γ 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                       : 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ?? 
                       
                     
                     := 
                     
                       
                         
                           ( 
                           
                             ?? 
                             , 
                             ℬ 
                             , 
                             
                               d 
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             , 
                             ρ 
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         accepts 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         Γ 
                       
                       := 
                       
                         { 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                         } 
                       
                     
                   
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     184 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         
                           
                             then 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             compute 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               I 
                               δ 
                             
                           
                           ⊆ 
                           
                             { 
                             
                               1 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               L 
                             
                             } 
                           
                         
                         , 
                         
                           ( 
                           
                             
                               α 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               α 
                               L 
                             
                           
                           ) 
                         
                         , 
                         
                           
                             ( 
                             
                               
                                 β 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 β 
                                 L 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           and 
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           κ 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           with 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                         := 
                         
                           
                             h 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                               , 
                               0 
                             
                           
                           + 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                                 , 
                                 1 
                               
                             
                             ⁢ 
                             x 
                           
                           + 
                           … 
                           + 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                                 , 
                                 μ 
                               
                             
                             ⁢ 
                             
                               x 
                               μ 
                             
                           
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             all 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             τ 
                           
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           
                             m 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             and 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ι 
                           
                           = 
                           0 
                         
                         , 
                         
                           1 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           such 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           that 
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           · 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             κ 
                           
                         
                         = 
                         
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   a 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     and 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           · 
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                           f 
                           τ 
                           
                             - 
                             κ 
                           
                         
                       
                       = 
                       
                         
                           
                             b 
                             0 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         + 
                         
                           
                             ∑ 
                             
                               i 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                             
                               β 
                               i 
                             
                             ⁢ 
                             
                               
                                 b 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           e 
                           ( 
                           
                             
                               k 
                               0 
                               * 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   c 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 k 
                                 0 
                                 * 
                               
                               , 
                               
                                 c 
                                 
                                   o 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                   , 
                                   
                                     c 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     , 
                                     - 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           k 
                                           t 
                                           * 
                                         
                                         , 
                                         
                                           c 
                                           i 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               0 
                                             
                                             ) 
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     / 
                                     
                                       ( 
                                       
                                         
                                           
                                             v 
                                             → 
                                           
                                           i 
                                         
                                         · 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         K 
                         
                           τ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           e 
                           ( 
                           
                             
                               k 
                               0 
                               * 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   c 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 k 
                                 0 
                                 * 
                               
                               , 
                               
                                 c 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                   , 
                                   
                                     c 
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     , 
                                     - 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           k 
                                           t 
                                           * 
                                         
                                         , 
                                         
                                           c 
                                           i 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               1 
                                             
                                             ) 
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       β 
                                       i 
                                     
                                     / 
                                     
                                       ( 
                                       
                                         
                                           
                                             v 
                                             → 
                                           
                                           i 
                                         
                                         · 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           I 
                           
                             δ 
                             , 
                             + 
                           
                         
                       
                       := 
                       
                         
                           { 
                           
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               | 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               ) 
                             
                           
                           } 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       I 
                       
                         δ 
                         , 
                         - 
                       
                     
                     := 
                     
                       
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     δ 
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                             } 
                           
                           . 
                           
                               
                           
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           return 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           msg 
                           ′ 
                         
                       
                       := 
                       
                         
                           c 
                           
                             d 
                             + 
                             1 
                           
                         
                         / 
                         
                           
                             ( 
                             
                               
                                 ∏ 
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 m 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     0 
                                   
                                 
                                 ⁢ 
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     1 
                                   
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The functional encryption scheme has been described above. If the KeyGen algorithm and Dec algorithm are modified as indicated in Formulas 185 to 187, an attribute-based encryption scheme may be realized. With the attribute-based encryption scheme, in the Setup algorithm, n t  is 2mf max k max +2. The Setup algorithm is the same as the Setup algorithm indicated in Formula 149, and the Enc algorithm is the same as the Enc algorithm indicated in Formula 152. 
     
       
         
           
             
               
                 
                   
                     
                       KeyGen 
                       ( 
                       
                         pk 
                         , 
                         sk 
                         , 
                         
                           ?? 
                           := 
                           
                             ( 
                             
                               ?? 
                               , 
                               ℬ 
                               , 
                               
                                 
                                   d 
                                   ⁡ 
                                   
                                     ( 
                                     x 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     ∏ 
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     m 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         τ 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         x 
                                         ) 
                                       
                                     
                                     
                                       f 
                                       τ 
                                     
                                   
                                 
                               
                               , 
                               ρ 
                             
                             ) 
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         π 
                         τ 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       ( 
                       
                         
                           τ 
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           m 
                           - 
                           1 
                         
                       
                       ) 
                     
                     , 
                     
                       
                         π 
                         m 
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             π 
                             τ 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         π 
                         
                           τ 
                           , 
                           κ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     185 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       π 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         π 
                         τ 
                       
                       - 
                       
                         
                           π 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       τ 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     ( 
                     
                       
                         τ 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                     ) 
                   
                   , 
                   
                     
                       χ 
                       m 
                     
                     := 
                     
                       1 
                       - 
                       
                         
                           ∑ 
                           
                             τ 
                             = 
                             1 
                           
                           
                             m 
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           χ 
                           τ 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       χ 
                       
                         τ 
                         , 
                         κ 
                         , 
                         1 
                       
                     
                     := 
                     
                       
                         χ 
                         τ 
                       
                       - 
                       
                         
                           χ 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               τ 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               m 
                               ; 
                               
                                 κ 
                                 = 
                                 0 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               f 
                               τ 
                             
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       τ 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   m 
                   , 
                   
                     κ 
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     f 
                     τ 
                   
                   , 
                   
                     ι 
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     γ 
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                     
                   
                   , 
                   
                     
                       η 
                       → 
                     
                     
                       0 
                       , 
                       0 
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       
                         0 
                         , 
                         
                           μ 
                           + 
                           1 
                         
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       j 
                     
                     = 
                     0 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   μ 
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       k 
                       
                         0 
                         , 
                         j 
                       
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             0 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         κ 
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   j 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       
                         0 
                         , 
                         j 
                       
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             1 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         γ 
                                         j 
                                       
                                       · 
                                       
                                         
                                           
                                             d 
                                             τ 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             γ 
                                             ) 
                                           
                                         
                                         
                                           
                                             f 
                                             τ 
                                           
                                           - 
                                           κ 
                                         
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   j 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       s 
                       0 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       0 
                     
                   
                   , 
                   
                     
                       s 
                       0 
                     
                     := 
                     
                       
                         
                           - 
                           
                             
                               b 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               γ 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ι 
                       
                       = 
                       1 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       
                         0 
                         , 
                         
                           μ 
                           + 
                           1 
                         
                       
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         s 
                                         0 
                                       
                                       + 
                                       
                                         π 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       0 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                               
                                 χ 
                                 
                                   τ 
                                   , 
                                   κ 
                                   , 
                                   ι 
                                 
                               
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         0 
                         * 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ξ 
                         
                           i 
                           , 
                           τ 
                           , 
                           ι 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         
                           ?? 
                           q 
                         
                         ⁡ 
                         
                           ( 
                           
                             
                               i 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               L 
                               ; 
                               
                                 τ 
                                 = 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               
                                 m 
                                 - 
                                 1 
                               
                               ; 
                               
                                 ι 
                                 = 
                                 0 
                               
                             
                             , 
                             1 
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ξ 
                         
                           i 
                           , 
                           m 
                           , 
                           ι 
                         
                       
                       := 
                       
                         - 
                         
                           
                             ∑ 
                             
                               τ 
                               = 
                               1 
                             
                             
                               m 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             
                               ξ 
                               
                                 i 
                                 , 
                                 τ 
                                 , 
                                 ι 
                               
                             
                             ⁡ 
                             
                               ( 
                               
                                 
                                   i 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   L 
                                   ; 
                                   
                                     ι 
                                     = 
                                     0 
                                   
                                 
                                 , 
                                 1 
                               
                               ) 
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         s 
                         i 
                       
                       := 
                       
                         
                           
                             - 
                             
                               
                                 a 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 γ 
                                 ) 
                               
                             
                           
                           + 
                           
                             
                               ξ 
                               
                                 i 
                                 , 
                                 τ 
                                 , 
                                 0 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ι 
                           
                         
                         = 
                         0 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         s 
                         i 
                       
                       := 
                       
                         
                           
                             - 
                             
                               
                                 b 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 γ 
                                 ) 
                               
                             
                           
                           + 
                           
                             
                               ξ 
                               
                                 i 
                                 , 
                                 τ 
                                 , 
                                 1 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ι 
                           
                         
                         = 
                         1 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             v 
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
                         θ 
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           t 
                         
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     186 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       
                                         s 
                                         i 
                                       
                                       + 
                                       
                                         
                                           θ 
                                           i 
                                         
                                         ⁢ 
                                         
                                           v 
                                           i 
                                         
                                       
                                       - 
                                       
                                         θ 
                                         i 
                                       
                                     
                                     , 
                                     
                                       
                                         e 
                                         → 
                                       
                                       i 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             v 
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       
                         w 
                         t 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       
                         * 
                         
                           ( 
                           
                             τ 
                             , 
                             κ 
                             , 
                             ι 
                           
                           ) 
                         
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ( 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     
                                       s 
                                       i 
                                     
                                     ⁢ 
                                     
                                       v 
                                       i 
                                     
                                   
                                   , 
                                   
                                     s 
                                     i 
                                   
                                   , 
                                   
                                     
                                       e 
                                       → 
                                     
                                     i 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 ) 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 n 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 t 
                               
                             
                           
                           ⁢ 
                           
                             
                               0 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 t 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ?? 
                         t 
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         ?? 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           ?? 
                           , 
                           
                             
                               { 
                               
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     0 
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     
                                       μ 
                                       + 
                                       1 
                                     
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 , 
                                 
                                   k 
                                   1 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   k 
                                   L 
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 1 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 m 
                                 ; 
                                 
                                   κ 
                                   = 
                                   0 
                                 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   f 
                                   τ 
                                 
                                 ; 
                                 
                                   ι 
                                   = 
                                   0 
                                 
                               
                               , 
                               1 
                             
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         Dec 
                         ( 
                         
                           pk 
                           , 
                           
                             
                               sk 
                               ?? 
                             
                             := 
                             
                               ( 
                               
                                 ?? 
                                 , 
                                 
                                   
                                     { 
                                     
                                       
                                         k 
                                         
                                           0 
                                           , 
                                           0 
                                         
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                         
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         k 
                                         
                                           0 
                                           , 
                                           
                                             μ 
                                             + 
                                             1 
                                           
                                         
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                         
                                       
                                       , 
                                       
                                         k 
                                         1 
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                         
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         k 
                                         L 
                                         
                                           * 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               κ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                     } 
                                   
                                   
                                     
                                       τ 
                                       = 
                                       1 
                                     
                                     , 
                                     
                                         
                                     
                                     ⁢ 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       m 
                                       ; 
                                       
                                         κ 
                                         = 
                                         0 
                                       
                                     
                                     , 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           f 
                                           τ 
                                         
                                       
                                       ; 
                                       
                                         ι 
                                         = 
                                         0 
                                       
                                     
                                     , 
                                     1 
                                   
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               ct 
                               Γ 
                             
                             := 
                             
                               ( 
                               
                                 Γ 
                                 , 
                                 
                                   c 
                                   0 
                                 
                                 , 
                                 
                                   
                                     { 
                                     
                                       c 
                                       t 
                                     
                                     } 
                                   
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                     ∈ 
                                     Γ 
                                   
                                 
                                 , 
                                 
                                   c 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                       : 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ?? 
                       
                     
                     := 
                     
                       
                         
                           ( 
                           
                             ?? 
                             , 
                             ℬ 
                             , 
                             
                               d 
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             , 
                             ρ 
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         accepts 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         Γ 
                       
                       := 
                       
                         { 
                         
                           ( 
                           
                             t 
                             , 
                             
                               x 
                               t 
                             
                           
                           ) 
                         
                         } 
                       
                     
                   
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     187 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         
                           
                             then 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             compute 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               I 
                               δ 
                             
                           
                           ⊆ 
                           
                             { 
                             
                               1 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               L 
                             
                             } 
                           
                         
                         , 
                         
                           ( 
                           
                             
                               α 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               α 
                               L 
                             
                           
                           ) 
                         
                         , 
                         
                           
                             ( 
                             
                               
                                 β 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 β 
                                 L 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           and 
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           κ 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           with 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                         := 
                         
                           
                             h 
                             
                               τ 
                               , 
                               κ 
                               , 
                               ι 
                               , 
                               0 
                             
                           
                           + 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                                 , 
                                 1 
                               
                             
                             ⁢ 
                             x 
                           
                           + 
                           … 
                           + 
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 ι 
                                 , 
                                 μ 
                               
                             
                             ⁢ 
                             
                               x 
                               μ 
                             
                           
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             all 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             τ 
                           
                           = 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           
                             m 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             and 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ι 
                           
                           = 
                           0 
                         
                         , 
                         
                           1 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           such 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           that 
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 0 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           · 
                           
                             
                               
                                 d 
                                 τ 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                             κ 
                           
                         
                         = 
                         
                           
                             
                               a 
                               0 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               ⁢ 
                               
                                 
                                   a 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   x 
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     and 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           
                             
                               h 
                               
                                 τ 
                                 , 
                                 κ 
                                 , 
                                 1 
                               
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           · 
                           
                             
                               d 
                               τ 
                             
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                         
                         ⁢ 
                         
                           f 
                           τ 
                           
                             - 
                             κ 
                           
                         
                       
                       = 
                       
                         
                           
                             b 
                             0 
                           
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         + 
                         
                           
                             ∑ 
                             
                               i 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                             
                               β 
                               i 
                             
                             ⁢ 
                             
                               
                                 b 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 x 
                                 ) 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         K 
                         
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           e 
                           ( 
                           
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     0 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         0 
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     t 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           0 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     , 
                                     - 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 0 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     / 
                                     
                                       ( 
                                       
                                         
                                           v 
                                           i 
                                         
                                         · 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         K 
                         
                           τ 
                           , 
                           1 
                         
                       
                       := 
                       
                         
                           e 
                           ( 
                           
                             
                               c 
                               0 
                             
                             , 
                             
                               
                                 ∑ 
                                 
                                   j 
                                   = 
                                   0 
                                 
                                 μ 
                               
                               ⁢ 
                               
                                 
                                   h 
                                   
                                     τ 
                                     , 
                                     κ 
                                     , 
                                     1 
                                     , 
                                     j 
                                   
                                 
                                 ⁢ 
                                 
                                   k 
                                   
                                     0 
                                     , 
                                     j 
                                   
                                   
                                     * 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         κ 
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         · 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 
                                   0 
                                   , 
                                   
                                     μ 
                                     + 
                                     1 
                                   
                                 
                                 
                                   * 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       κ 
                                       , 
                                       1 
                                     
                                     ) 
                                   
                                 
                               
                             
                             ) 
                           
                         
                         · 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               , 
                               + 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     t 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     
                                       * 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           κ 
                                           , 
                                           1 
                                         
                                         ) 
                                       
                                     
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               · 
                               
                                 
                                   ∏ 
                                   
                                     
                                       i 
                                       ∈ 
                                       
                                         I 
                                         δ 
                                       
                                     
                                     , 
                                     - 
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     e 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           c 
                                           t 
                                         
                                         , 
                                         
                                           k 
                                           i 
                                           
                                             * 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 κ 
                                                 , 
                                                 1 
                                               
                                               ) 
                                             
                                           
                                         
                                       
                                       ) 
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       β 
                                       i 
                                     
                                     / 
                                     
                                       ( 
                                       
                                         
                                           v 
                                           i 
                                         
                                         · 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         where 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           I 
                           
                             δ 
                             , 
                             + 
                           
                         
                       
                       := 
                       
                         
                           { 
                           
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   δ 
                                 
                               
                               | 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   v 
                                   i 
                                 
                               
                               ) 
                             
                           
                           } 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       I 
                       
                         δ 
                         , 
                         - 
                       
                     
                     := 
                     
                       
                         
                           
                             { 
                             
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     δ 
                                   
                                 
                                 | 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       v 
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                             } 
                           
                           . 
                           
                               
                           
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           return 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           msg 
                           ′ 
                         
                       
                       := 
                       
                         
                           c 
                           
                             d 
                             + 
                             1 
                           
                         
                         / 
                         
                           
                             ( 
                             
                               
                                 ∏ 
                                 
                                   τ 
                                   = 
                                   1 
                                 
                                 m 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     0 
                                   
                                 
                                 ⁢ 
                                 
                                   K 
                                   
                                     τ 
                                     , 
                                     1 
                                   
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     By conducting the same modification, the CP-FE scheme indicated in Formulas 181 to 184 can be altered to the attribute-based encryption scheme. 
     In the above explanation, n 0 +u 0 +w 0 +z 0  is set in N 0  and n t +u t +w t +z t  is set in N t . K for example, u 0 =n 0 , w 0 =n 0 , and z 0 =2, then n 0 +n 0 +n 0 +2=3n 0 +2 may be set in N 0 . If u t =n t , w t =n t , and z t =2, then n t +n, +n t +2=3n t +2 may be set in N t . 
     The above explanation presents a functional encryption scheme in which, as with the functional encryption scheme according to Embodiment 2, the length of the decryption key and ciphertext increases but the number of bases decreases. Based on the functional encryption scheme according to Embodiments 3 and 4, the functional encryption scheme according to Embodiment 4 can be easily transformed into a functional encryption scheme in which the number of bases increases but the degree number of each basis decreases, as with the functional encryption scheme according to Embodiment 3. 
     The above embodiments explained the KP-FE scheme and the CP-FE scheme. The Unified-Policy FE (UP-FE) scheme described in Non-Patent Literature 4 can be easily constructed from the KP-FE scheme and the CP-FE scheme. 
     Embodiment 5. 
     In the above embodiments, the method of implementing the cryptographic process in the dual vector spaces has been described. In Embodiment 5, a method of implementing a cryptographic process in dual additive groups will be described. 
     In brief, in the above embodiments, a cryptographic primitive process is implemented in the cyclic group of the prime order q. If a ring R is expressed using a composite number M, as in Formula 188, the cryptographic process described in the above embodiments can be applied to an additive group having a ring R as a coefficient.
 
           :=         / M                 [Formula 188]
 
where
             : an integer; and   M: a composite number   

     If F q  in the algorithm explained in the above embodiments is changed to R, the cryptographic primitive process in the dual additive group can be implemented. 
     In the above embodiments, from the viewpoint of security proof, ρ(i) concerning each integer i of i=1, . . . , L can be limited to a positive tuple (t, v → ) or negative tuple            (t, v → ) for different corresponding identification information t.
     In other words, let a function ρ ˜  be map of {1, . . . , L}→{1, . . . , d} being ρ ˜ (i)=t when ρ(i)=(t, v → ) or ρ(i)=           (t, v → ). In this case, ρ ˜  may be limited to injection. Note that ρ(i) is ρ(i) in the access structure S:=(M, ρ(i)) described above.
     The hardware configuration of a cryptographic processing system  10  (a key generation device  100 , an encryption device  200 , and a decryption device  300 ) in this embodiment will be described. 
       FIG. 13  is a diagram showing an example of the hardware configuration of each of the key generation device  100 , the encryption device  200 , and the decryption device  300 . 
     As shown in  FIG. 13 , each of the key generation device  100 , encryption device  200 , and decryption device  300  includes a CPU  911  (Central Processing Unit; also referred to as central processing device, processing device, computation device, microprocessor, microcomputer, or processor) which executes programs. The CPU  911  is connected to a ROM  913 , a RAM  914 , an LCD  901  (Liquid Crystal Display), a keyboard  902  (K/B), a communication board  915 , and a magnetic disk device  920  via a bus  912 , and controls these hardware devices. In place of the magnetic disk device  920  (fixed disk device), a storage device such as an optical disk device or memory card read/write device may be employed. The magnetic disk device  920  is connected via a predetermined fixed disk interface. 
     The ROM  913  and the magnetic disk device  920  are examples of a nonvolatile memory. The RAM  914  is an example of a volatile memory. The ROM  913 , the RAM  914 , and the magnetic disk device  920  are examples of the storage device (memory). The keyboard  902  and the communication board  915  are examples of an input device. The communication board  915  is an example of a communication device. Furthermore, the LCD  901  is an example of a display device. 
     The magnetic disk device  920 , ROM  913 , or the like stores an operating system  921  (OS), a window system  922 , programs  923 , and files  924 . The CPU  911 , the operating system  921 , and the window system  922  execute each program of the programs  923 . 
     The programs  923  store software and programs that execute the functions described as the “master key generation part  110 ”, “master key storage part  120 ”, “information input part  130 ”, “decryption key generation part  140 ”, “key distribution part  150 ”, “public parameter acquisition part  210 ”, “information input part  220 ”, “encrypted data generation part  230 ”, “data transmission part  240 ”, “information acquisition part  310 ”, “span program calculation part  320 ”, “complementary coefficient calculation part  330 ”, “decryption part  340 ”, and the like in the above description, and other programs. The programs are read and executed by the CPU  911 . 
     The files  924  store information, data, signal values, variable values, and parameters such as the “public parameters pk”, “master secret key sk”, “decryption keys sk v  and sk Γ ”, “ciphertexts ct Γ  and ct s ”, “access structure S”, “attribute information”, “message msg”, and the like of the above explanation, as the items of a “file” and “database”. The “file” and “database” are stored in a recording medium such as a disk or memory. The information, data, signal values, variable values, and parameters stored in the recording medium such as the disk or memory are read out to the main memory or cache memory by the CPU  911  through a read/write circuit, and are used for the operations of the CPU  911  such as extraction, search, look-up, comparison, computation, calculation, process, output, print, and display. The information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, or buffer memory during the operations of the CPU  911  including extraction, search, look-up, comparison, computation, calculation, process, output, print, and display. 
     The arrows of the flowcharts in the above explanation mainly indicate input/output of data and signals. The data and signal values are recorded in the memory of the RAM  914 , the recording medium such as an optical disk, or in an IC chip. The data and signals are transmitted online via a transmission medium such as the bus  912 , signal lines, or cables; or electric waves. 
     The “part” in the above explanation may be a “circuit”, “device”, “equipment”, “means” or “function”; or a “step”, “procedure”, or “process”. The “device” may be a “circuit”, “equipment”, “means”, or “function”; or a “step”, “procedure”, or “process”. The “process” may be a “step”. Namely, the “part” may be implemented by firmware stored in the ROM  913 . Alternatively, the “part” may be implemented by only software; by only hardware such as an element, a device, a substrate, or a wiring line; by a combination of software and hardware; or furthermore by a combination of software, hardware, and firmware. The firmware and software are stored, as a program, in the recording medium such as the ROM  913 . The program is read by the CPU  911  and executed by the CPU  911 . Namely, the program causes the computer or the like to function as a “part” described above. Alternatively, the program causes the computer or the like to execute the procedure and method of the “part” described above. 
     REFERENCE SIGNS LIST 
       100 : key generation device;  110 : master key generation part;  120 : master key storage part;  130 : information input part;  140 : decryption key generation part;  141 : secret information generation part;  142 : key element generation part;  150 : key distribution part;  200 : encryption device;  210 : public parameter acquisition part;  220 : information input part;  230 : encrypted data generation part;  240 : data transmission part;  300 : decryption device;  311 : decryption key acquisition part;  312 : ciphertext acquisition part;  320 : span program calculation part;  330 : complementary coefficient calculation part;  331 : polynomial selection part;  332 : coefficient calculation part;  340 : decryption part;  341 : pairing operation part;  342 : message calculation part