## 6 Proof of Safety
\begin{array}{l}\left|Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}-Adv_{ \mathcal{A}}^{\text{EX}_{\text{F}}}\right|\\ =\left|Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}-Adv_{\mathcal{A}}^{\text{EX} _{0}}+Adv_{\mathcal{A}}^{\text{EX}_{0}}-\dots-Adv_{\mathcal{A}}^{\text{Ex}_ {\text{i}}}+Adv_{\mathcal{A}}^{\text{EX}_{\text{i}}}-\dots\\ -Adv_{\mathcal{A}}^{\text{EX}_{\text{q}}}+Adv_{\mathcal{A}}^{\text{Ex}_{ \text{q}}}-Adv_{\mathcal{A}}^{\text{Ex}_{\text{F}}}\right|\\ \leq\left|Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}-Adv_{\mathcal{A}}^{\text{ EX}_{0}}\right|+\left|Adv_{\mathcal{A}}^{\text{EX}_{0}}-Adv_{\mathcal{A}}^{\text{ EX}_{\text{i}}}\right|+\dots+\left|Adv_{\mathcal{A}}^{\text{Ex}_{\text{q}}}-Adv_{ \mathcal{A}}^{\text{EX}_{\text{F}}}\right|\\ \leq(q+2)\varepsilon\end{array} \]  
So, \(\left|Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}-Adv_{\mathcal{A}}^{\text{Ex}_ {\text{F}}}\right|\leq(q+2)\varepsilon\). Furthermore, according to theorem 6.8 given in [50], we obtain that \(Adv_{\mathcal{A}}^{\text{Ex}_{\text{F}}}\leq\varepsilon\). Thus, the proof of Theorem 1 is completed. **Lemma 1**. : _The maximum amount of one private key leakage can reach \(L_{SK_{1}}=L_{SK_{2}}=(1-2\Lambda)\theta\)._  
**Proof. ** We will utilize a result in ref. [26] to complete the proof. **Result 1** ([26]). : _Given a prime \(p\), we select \(n_{1}\geq n_{2}\geq 2\)\((n_{1},n_{2}\in N)\), a matrix \(X\gets Z_{p}^{n_{1}\times n_{2}}\) and a matrix \(Y\gets Rk_{1}(Z_{p}^{n_{2}\times 1})\), with rank 1 and \(\Theta\gets Z_{p}^{n_{1}}\). The leakage function is \(f:Z_{p}^{n_{1}}\to W\). As long as \(\left|W\right|\leq 4\cdot(1-\frac{1}{p})\cdot p^{n_{2}-1}\cdot\varepsilon^{2}\), the statistical distance \(SD((X,f(X\cdot Y)),(X,f(\Theta))\leq\varepsilon\), where \(\varepsilon\) is a negligible value._ \begin{table}
\begin{tabular}{c c} \hline \hline
**Two Consecutive Games** & **Differences of the Advantages** & **Lemmas** \\ \hline \(\text{EX}_{\text{R}}\) or \(\text{EX}_{0}\) & \(Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}-Adv_{\mathcal{A}}^{\text{Ex}_{\text{q}}} \)\(\leq\varepsilon\) & Lemma 2 \\ \(\text{EX}_{\text{i}}\) or \(\text{EX}_{\text{i}-1}\) & \(Adv_{\mathcal{A}}^{\text{EX}_{\text{i}-1}}-Adv_{\mathcal{A}}^{\text{EX}_{\text{i} }}\)\(\leq\varepsilon\) & Lemma 3 \\ \(i\in(1,\dots,q)\) & \(Adv_{\mathcal{A}}^{\text{EX}_{\text{i}}}-Adv_{\mathcal{A}}^{\text{Ex}_{\text{ F}}}\)\(\leq\varepsilon\) & Lemma 4 \\ \(\text{EX}_{\text{q}}\) or \(\text{EX}_{\text{F}}\) & \(Adv_{\mathcal{A}}^{\text{EX}_{\text{q}}}-Adv_{\mathcal{A}}^{\text{Ex}_{\text{F}}} \)\(\leq\varepsilon\) & Lemma 4 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The distinctions for the superiority achieved by the attacker between two consecutive games (CLR-SS-AIBBE). According to Result 1, the following Deduction 1 is obtained easily. **Deduction 1. **_Given a prime \(p\), we choose \(n_{1}\geq 3\), \(\stackrel{{\rightarrow}}{{\delta}}\leftarrow Z_{p}^{n_{1}}\), \(\stackrel{{\rightarrow}}{{\tau}}\leftarrow Z_{p}^{n_{1}}\) and \(\stackrel{{\rightarrow}}{{\tau}}^{\prime}\leftarrow Z_{p}^{n_{1}}\) such that the dot product of \(\stackrel{{\rightarrow}}{{\tau}}^{\prime}\) and \(\stackrel{{\rightarrow}}{{\delta}}\) is orthogonal with respect to the module \(p\). Suppose that the leakage function is \(f:Z_{p}^{n_{1}}\to W\). As long as \(\left|W\right|\leq 4\cdot(1-\frac{1}{p})\cdot p^{n_{1}-2}\cdot\varepsilon^{2}\), \(SD((\stackrel{{\rightarrow}}{{\delta}},f(\stackrel{{ \rightarrow}}{{\tau}}^{\prime})),(\stackrel{{ \rightarrow}}{{\delta}},f(\stackrel{{\rightarrow}}{{\tau}}))) \leq\varepsilon\)._  
**Proof. ** According to the conclusion 1, if \(n_{2}=n_{1}-1\), \(n_{1}=n_{2}+1\geq n_{2}\geq 2\). This basis of the orthogonal space of \(\stackrel{{\rightarrow}}{{\delta}}\) corresponds to \(X\) and \(\stackrel{{\rightarrow}}{{\tau}}\) corresponds to \(\Phi\). So, when \(Y\gets Rk_{1}(Z_{p}^{(n_{1}-1)\times 1})\), the distributions of \(\stackrel{{\rightarrow}}{{\tau}}^{\prime}\) are the same as \(X\cdot Y\).