# Efficient and HRA Secure Universal Conditional Proxy Re-Encryption for Cloud-Based Data Sharing
## 2 Preliminaries
### Homomorphic Encryption Schemes  
We will define universal conditional proxy re-encryption (UCPRE) in Section 3. Our UCPRE allows the proxy to transfer the ciphertext of the delegator under an encryption scheme \(\Pi_{f}\) into the ciphertext of the delegatee under a (possibly different) encryption scheme \(\Pi_{t}\). In the system, the schemes \(\Pi_{f}\) and \(\Pi_{t}\) are additively homomorphic encryption \(\Pi_{+}\) or multiplicatively homomorphic encryption \(\Pi_{\times}\), respectively. **Definition 1** (Additively homomorphic encryption (AHE) [29]). : _We say that the encryption scheme \(\Pi_{+}=(\mathsf{Setup},\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec},\mathsf{ Hom}_{+},\mathsf{ScalMul})\) over the message space \(\mathcal{M}\) is additively homomorphic if \(\mathsf{Setup}\), \(\mathsf{KeyGen}\), \(\mathsf{Enc}\), \(\mathsf{Dec}\), \(\mathsf{Hom}_{+}\), and \(\mathsf{ScalMul}\) are the following probabilistic polynomial time \(\mathcal{PPT}\) algorithms:_  
* \(\mathsf{Setup}\big{(}1^{\lambda}\big{)}\to(\mathsf{Par})\)_: It inputs a security parameter_ \(1^{\lambda}\) _and outputs the public parameter_ \(\mathsf{Par}\)_. For simplicity,_ \(\mathsf{Par}\) _is omitted from the input of algorithms._
* \(\mathsf{KeyGen}\big{(}1^{\lambda}\big{)}\to(\mathsf{sk},\mathsf{pk})\)_: It inputs a security parameter_ \(1^{\lambda}\) _and outputs the secret key_ \(\mathsf{sk}\) _and the public key_ \(\mathsf{pk}\)_._
* \(\mathsf{Enc}(\mathsf{pk},m)\to(\mathsf{ct})\)_: It inputs the public key_ \(\mathsf{pk}\) _and a message_ \(m\in\mathcal{M}\) _and outputs a ciphertext_ \(\mathsf{ct}\)_._
* \(\mathsf{Dec}(\mathsf{sk},\mathsf{ct})\to(m)\)_: It inputs a secret key_ \(\mathsf{sk}\) _and a ciphertext_ \(\mathsf{ct}\) _and outputs a message_ \(m\in\mathcal{M}\) _or a symbol_ \(\bot\)_._
* \(\mathsf{Hom}_{+}(\mathsf{pk},\mathsf{ct},\mathsf{ct}^{\prime})\to(\mathsf{ct} ^{\prime\prime})\)_: It inputs a public key_ \(\mathsf{pk}\) _and the ciphertext_ \(\mathsf{ct}\) _encrypting_ \(m\) _and the ciphertext_ \(\mathsf{ct}^{\prime}\) _encrypting_ \(m^{\prime}\) _and outputs a ciphertext_ \(\mathsf{ct}^{\prime\prime}\) _so that_ \(\Pi_{+}.\mathsf{Dec}\;(\mathsf{sk},\mathsf{ct}^{\prime\prime})=m+m^{\prime}\in \mathcal{M}\)_._
* \(\mathsf{ScalMul}(\mathsf{pk},\mathsf{ct},\mathsf{a})\to(\mathsf{ct}^{\prime})\)_: It inputs a public key_ \(\mathsf{pk}\)_, a ciphertext_ \(\mathsf{ct}\) _encrypting_ \(m\) _and a plaintext_ \(\mathsf{a}\in\mathcal{M}\) _and outputs a ciphertext_ \(\mathsf{ct}^{\prime}\) _such that_ \(\Pi_{+}.\mathsf{Dec}\;(\mathsf{sk},\mathsf{ct}^{\prime})=\mathsf{a}\times m\in \mathcal{M}\)_._  
**Definition 2** (Multiplicatively homomorphic encryption (MHE) [29]). : _We say that the scheme \(\Pi_{\times}=(\mathsf{Setup},\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec}, \mathsf{Hom}_{\times},\mathsf{ScalMul})\) over the message space \(\mathcal{M}\) is multiplicatively homomorphic if \(\mathsf{Setup},\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec},\mathsf{Hom}_{\times}\), and \(\mathsf{ScalMul}\) are the following \(\mathcal{PPT}\) algorithms:_  
* _Setup,_ \(\mathsf{KeyGen}\)_,_ \(\mathsf{Enc}\) _and_ \(\mathsf{Dec}\) _algorithms are the same as the Definition_ 1_._* \(\mathrm{Hom}_{\times}(\mathrm{pk},\mathrm{ct},\mathrm{ct}^{\prime})\to(\mathrm{ct} ^{\prime\prime})\)_: It inputs a public key \(\mathrm{pk}\) and the ciphertext \(\mathrm{ct}\) encrypting \(m\) and the ciphertext \(\mathrm{ct}^{\prime}\) encrypting \(m^{\prime}\) and outputs a ciphertext \(\mathrm{ct}^{\prime\prime}\) such that \(\Pi_{\times}\).Dec \((\mathrm{sk},\mathrm{ct}^{\prime\prime})=m\times m^{\prime}\in\mathcal{M}\)_. * \(\mathrm{ScalMul}(\mathrm{pk},\mathrm{ct},\mathrm{a})\to(\mathrm{ct}^{\prime})\)_: It inputs a public key \(pk\), a ciphertext \(c\) encrypting \(m\) and a plaintext \(\alpha\in\mathcal{M}\) and outputs a ciphertext \(\mathrm{ct}^{\prime}\) such that \(\Pi_{\times}\).Dec \((\mathrm{sk},\mathrm{ct}^{\prime})=\alpha\times m\in\mathcal{M}\)_. Note that the above encryption schemes need to satisfy the correctness in the usual situation.