# Proxy Re-Encryption Scheme for Decentralized Storage Networks
## 4 Proxy Re-Encryption Scheme
### Security Analysis  
Our collusion-resilience PRE scheme is CCA-secure in a random oracle model, under the modified-computation Diffie-Hellman (mCDH) assumption [24]. In this section, we prove the scheme under mCDH assumption [24] that any efficient algorithm's mCDH advantage is negligible. Theorem 1: _Our PRE scheme \(\prod\) is IND-PRE-CCA-secure under the assumption of the mCDH [24] in group \(\mathbb{G}\), and the Schnorr signature [25] is EUF-CMA-secure in the random oracle model. Anadversary \(\mathcal{A}\), who asks at most \(q_{H_{i}}\) random oracle queries to \(H_{i}\) with \(i\in\{1,\ldots,4\}\), can effectively break the \((t,qu_{u},q_{c},q_{re},q_{d},\epsilon)\)-IND-PRE-CCA of our scheme \(\prod\), for any \(0<\
u<\epsilon\). Thus we have:  
* The \((t^{\prime},\epsilon^{\prime})\)-\(m\)CDH problem [24] in group \(\mathbb{G}\) can be solved by an algorithm \(\mathcal{B}\) with Equations (27) and (28): \[ \begin{split} t^{\prime}\leq t&+(q_{H_{1}}+q_{H_{2 }}+q_{H_{3}}+q_{H_{4}}\\ &+q_{u}+q_{c}+q_{rk}+q_{re}+q_{d})\mathcal{O}(1)\\ &+(q_{u}+q_{c}+4q_{re}+3q_{d}+(2q_{d}+q_{re})q_{H_{2}})t_{e},\end{split} \] (27) \[ \begin{split} e^{\prime}\geq\frac{1}{q_{H_{3}}}(2(\epsilon-\
u)- \frac{q_{H_{2}}+(q_{H_{2}}+q_{H_{3}})q_{d}}{2^{\omega+1}}-\frac{2q_{d}+q_{re}} {q}).\end{split} \] (28) where \(t_{e}\) is the exponential running time in the group \(\mathbb{G}\). * The EUF-CMA security of the Schnorr signature [25] can be broken by an attacker with advantage \(\
u\) within time \(t^{\prime}\). Proof. : It is assumed that the Schnorr signature [25] is \((t^{\prime},\epsilon^{\prime})\)-EUF-CMA-secure for the probability \(0<\
u<\epsilon\). While the CDH problem (given \(g,g^{x},g^{y}\) output \(g^{xy}\)) is as hard as the mCDH problem [24] (given \(g,g^{\frac{1}{x}},g^{x},g^{y}\) outputs \(g^{xy}\)), this theorem is proved under the mCDH problem [24]. A \(t\)-time adversary \(\mathcal{A}\) can break the IND-PRE-CCA security of scheme \(\prod\) with advantage \(\epsilon-\
u\). We show how an algorithm \(\mathcal{B}\) solves the \((t^{\prime},\epsilon^{\prime})\)-mCDH problem [24] in group \(\mathbb{G}\). Suppose algorithm \(\mathcal{B}\) accepts the input of mCDH challenge tuple \((g,g^{x},g^{\frac{1}{x}},g^{y})\in\mathbb{G}^{4}\), and \(x,y+\mathbb{Z}_{p}\) is unknown. Algorithm \(\mathcal{B}\) plays the role of challenger playing the IND-PRE-CCA game with adversary \(\mathcal{A}\). Algorithm \(\mathcal{B}\)'s goal is to output \(g^{xy}\). **Setup. ** Algorithm \(\mathcal{B}\) passes parameters \((p,\mathbb{G},g,H_{1},H_{2},H_{3},H_{4},l_{0},l_{1})\) to adversary \(\mathcal{A}\). \(H_{1},H_{2},H_{3},H_{4}\) are random hash oracles controlled by the algorithm \(\mathcal{B}\). **Hash Oracle Queries. ** Adversary \(\mathcal{A}\) may send the queries to random oracle \(H_{1}\), \(H_{2}\), \(H_{3}\), and \(H_{4}\) at any time. Algorithm \(\mathcal{B}\) has four empty lists \(H_{1}^{list}\), \(H_{2}^{list}\), \(H_{3}^{list}\), and \(H_{4}^{list}\) initially, used for storing the query parameters and result value tuples. * \(H_{1}\) queries. With the parameters \((a,r)\), if this query exists in the \(H_{1}^{list}\) as a tuple \((a,r,d)\), output the value \(d\) as the result to adversary \(\mathcal{A}\). Otherwise, choose \(d\leftarrow\mathbb{Z}_{p}\) and add the tuple \((a,r,d)\) to the hash list \(H_{1}^{list}\), and respond with \(H_{1}(a,r)=d\) to adversary \(\mathcal{A}\). * \(H_{2}\) queries. With the parameters \((m,w)\), if this query exists in the \(H_{2}^{list}\) as a tuple \((m,w,v)\), output the value \(v\) as the result to adversary \(\mathcal{A}\). Otherwise, choose \(v\leftarrow\mathbb{Z}_{p}\) and add the tuple \((m,w,v)\) to the hash list \(H_{2}^{list}\), and respond with \(H_{2}(m,w)=v\) to adversary \(\mathcal{A}\). * \(H_{3}\) queries. With the parameters \((g^{d},E)\), if this query exists in the \(H_{3}^{list}\) as a tuple \((g^{d},E,\alpha)\), output the value \(\alpha\) as the result to adversary \(\mathcal{A}\).