# Proxy Re-Encryption Scheme for Decentralized Storage Networks
## 4 Proxy Re-Encryption Scheme
### Security Analysis
Otherwise, choose \(\alpha\leftarrow\{0,1\}^{l}\) and add the tuple \((g^{d},E,\alpha)\) to the hash list \(H_{3}^{list}\), and respond with \(H_{3}(g^{d},E)=\alpha\) to adversary \(\mathcal{A}\). * \(H_{4}\) queries. With the parameters \((E,F)\), if this query exists in the \(H_{4}^{list}\) as a tuple \((E,F,\beta)\), output the value \(\beta\) as the result to adversary \(\mathcal{A}\). Otherwise, choose \(\beta\leftarrow\mathbb{Z}_{p}\) and add the tuple \((E,F,\beta)\) to the hash list \(H_{4}^{list}\), and respond with \(H_{4}(E,F)=\beta\) to adversary \(\mathcal{A}\). **Phase 1. ** The adversary \(\mathcal{A}\) sends a series of queries as in the definition of the IND-PRE-CCA game. The algorithm \(\mathcal{B}\) holds three hash lists \(K_{Unorrupted}^{list}\), \(K_{Corrupted}^{list}\), and \(R^{list}\), answering the adversary \(\mathcal{A}\) as follows:  
* Uncorrupted key generation query \(q_{u}\). If the tuple \((a,g^{a})\) is not in the hash list \(K_{Unorrupted}^{list}\), the algorithm \(\mathcal{B}\) chooses \(a\leftarrow\mathbb{Z}_{p}\); add the tuple \((a,g^{a})\) to the hash list \(K_{Unorrupted}^{list}\). Respond with \(pk=g^{a}\) to adversary \(\mathcal{A}\). * Corrupted key generation query \(q_{c}\). If the tuple \((a,g^{a})\) is not in the hash list \(K_{Corrupted}^{list}\), the algorithm \(\mathcal{B}\) chooses \(a\leftarrow\mathbb{Z}_{p}\); add the tuple \((a,g^{a})\) to the hash list \(K_{Corrupted}^{list}\). Respond with \((sk,pk)=(a,g^{a})\) to adversary \(\mathcal{A}\). * Re-encryption key generation query \(q_{rk}\). The re-key generation is from [PERSON]'s secret key and [PERSON]'s public key; both key pairs can be uncorrupted or corrupted. It is because in the re-encryption from \(c_{A}\) to \(c_{B}\), ciphertexts can be decrypted by either \(sk_{A}\) or \(sk_{B}\). In the case algorithm, \(\mathcal{B}\) recovers \((sk_{A},pk_{A}),(sk_{B},pk_{B})\) from \(K_{Uncorrupted}^{list}\) or \(K_{Corrupted}^{list}\). Then, algorithm \(\mathcal{B}\) generates re-key \(rk_{A\to B}=(\frac{pk_{B}}{pk_{A}})^{H_{1}(sk_{A}r)}=(\frac{b}{g^{a}})^{H_{1}( \alpha,r)}\). The tuple \((sk_{A},pk_{A},sk_{B},pk_{B},rk_{A\to B})\) is added to the \(R^{list}\). Then, the \(rk_{A\to B}\) is returned to adversary \(\mathcal{A}\). For the challenge purpose, both \(sk_{A}\) and \(sk_{B}\) should be uncorrupted. * Re-Encryption query \(q_{re}\). Given \(rk_{A\to B}\) and \(c_{A}=\langle D_{A},r,E,F,V,S\rangle\): If \(S\
eq V\cdot pk_{A}^{r}\), it outputs \(\bot\). Otherwise, the algorithm returns the re-encrypted ciphertext \(c_{B}=\langle D_{A}\cdot rk_{A\to B},r,E,F,V,S\rangle\) to adversary \(\mathcal{A}\). * Decryption query \(q_{d}\). The algorithm recovers \(sk\) from \(K_{Uncorrupted}^{list}\) or \(K_{Corrupted}^{list}\). Run \((m,w)=Dec(sk,c)\). If \(E=g^{H_{2}(m,w)}\), give \(m\) back to the adversary, otherwise it outputs \(\bot\). **Challenge. ** When adversary \(\mathcal{A}\) ends Phase 1, the adversary outputs a target public key \(pk^{*}\) and two equal-length messages \(m_{0},m_{1}\in\{0,1\}^{l_{0}}\), queries to algorithm \(\mathcal{B}\). Algorithm \(\mathcal{B}\) responds as follows:  
1. Recovers \((sk^{*},pk^{*})\) from \(K_{Uncorrupted}^{list}\) and let \(pk^{*}=g^{a}:=g^{\frac{1}{2}}\). 2. Let \(D^{*}=(pk^{*})^{d}=(g^{a})^{d}:=g^{y}\), so that \((g^{a})^{d}=(g^{\frac{1}{2}})^{xy}\). We can obtain \(d=xy\) as \(g^{a}=g^{\frac{1}{2}}\). Then, \(g^{d}=g^{xy}\). 3. As \(F=H_{3}(g^{d},E)\oplus(m||w)\) defined, choose \(\delta\leftarrow\{0,1\},w^{*}\leftarrow\{0,1\}^{l_{1}}\) and \(F^{*}=H_{3}(g^{d},E^{*})\oplus(m_{\delta}||w^{*})\). 4. Return \(c^{*}=\langle D^{*},r^{*},E^{*},F^{*},V^{*},S^{*}\rangle\) as the challenged ciphertext to adversary \(\mathcal{A}\). **Phase 2. ** The adversary \(\mathcal{A}\) issues the queries as in Phase 1. Algorithm \(\mathcal{B}\) responds to those queries to \(\mathcal{A}\) as in Phase 1. **Guess. ** The adversary \(\mathcal{A}\) responds a guess \(\delta\in\{0,1\}\) to \(\mathcal{B}\).