# Secure Proxy Re-Encryption Protocol for FANETs Resistant to Chosen-Ciphertext Attacks
## 5 Security Analysis  
### Proof of Security  
**Theorem 1**. : (_Unidirectional Proxy Re-Encryption CCA Security_) UIPF(_unidirectional proxy re-encryption in FANETs_) is secure according to _Uni-PRE-CCA game_, if GDDH is hard. Proof. : We use contraposition. A is assumed as an adversary that wins the Uni-PRE-CCA game with advantage \(\varepsilon\). We construct the adversary \(\Delta\), which uses A as a subroutine and breaks the GDDH with non-negligible advantage. _Phase 1_. The adversary A initiates queries \(q_{1}\),..., \(q_{n}\), with each \(q_{i}\) being one of the following:  
The oracle \(\mathcal{O}_{pk}\)(public key generation): When provided with an index \(i\), \(\Delta\) conclusively determines whether \(pk_{i}\) is the attacked public key \(pk^{*}\). If affirmative, \(\Delta\) initializes \((g,\ g^{\prime},\ g^{x},\ g^{xr})\) and records this information in table \(T_{k}\). Otherwise, \(\Delta\) executes KGen \(\rightarrow(pk_{i},sk_{i})\) and provides \(pk_{i}(=g^{x})\) to A, and records \((g,\ g^{x},\ g^{xr},\ g^{xr},\ x(=sk))\) in \(T_{k}\). \(\mathcal{O}_{pk}\)(secret key generation): Given the input \(pk_{X}=(g,\ g^{\prime},\ g^{x},\ g^{xr})\), \(\Delta\) verifies the existence of \(pk_{X}\) in \(T_{k}\). If \(pk_{X}\) is not found, \(\Delta\) terminates. In case \(pk_{X}\) is the attacked public key, \(\Delta\) reports failure and aborts. Otherwise, \(\Delta\) replies to A with \((p_{x},\ q_{x})\) and records \(pk_{X}\) into \(T_{sk}\). \(\mathcal{O}_{pk}\)(re-encryption key generation): Given the input \((pk_{X},\ pk_{Y})\), \(\Delta\) verifies the existence of both \(pk_{X}\). If either is missing, \(\Delta\) terminates. Subsequently, \(\Delta\) checks whether \((pk_{X},\ pk_{Y},rk_{X\to Y}^{1},\ rk_{X\to Y}^{2})\) is present in \(T_{rk}\). If it is, \(\Delta\) returns \((rk_{X\to Y}  
If \(pk_{X}\) is the guessed attacked public key and \(pk_{Y}\) is in \(T_{sk}\), \(\Delta\) selects random numbers \(x_{X},\ x_{Y},\ \alpha,\gamma\), puts \(rk_{X\to Y}=(rk_{X\to Y}^{1},\ rk_{X\to Y}^{2})=((S_{1},\ S_{2}),(S_{3},\ S_{4}))\), and returns \((rk_{X\to Y}^{1},\ R_{1},R_{2})\) to \(\Delta\), stores it in \(T_{ure}\). Otherwise, \(\Delta\) calls \(\mathfrak{O}_{rk}\) to obtain \(rk_{X\to Y}\), and returns \(\text{PrxyRE}(rk_{X\to Y}^{1},C)\) and stores it in \(T_{tre}\). \(\mathfrak{O}_{dec}(\text{decryption})\): When receiving input \((pk_{X},\ rk_{X\to Y}^{1},\ R_{1},\ R_{2})\), \(\Delta\) checks whether \(rk_{X\to Y}^{1}\) is present in either \(T_{rk}\) or \(T_{urk}\). If it is absent in both, \(\Delta\) terminates. However: If \(rk_{X\to Y}^{1}\) is not the guessed attacked re-encryption key, \(\Delta\) knows \(rk_{X\to Y}^{2}=(S_{3},\ S_{4})\) from \(T_{rk}\). \(\Delta\) responds A with \(m\gets Dec\big{(}rk_{X\to Y}^{2},\ R_{1},R_{2}\big{)}\). If \(rk_{X\to Y}^{1}\) is the guessed attacked re-encryption key and \(RE=(rk_{X\to Y}^{1},\ R_{1},\ R_{2})\), \(\Delta\) searches \((pk_{X},\ pk_{Y},\ \alpha^{*},\ b^{*},\ c^{*},\ a^{*})\) in \(T_{urk}\) or \((\alpha^{*},\ R_{1},\ R_{2})\) in \(T_{ure}\), for \(a^{*}=rk_{X\to Y}^{1}\). If it does not exist, \(m\leftarrow\text{Dec}(b^{*},R_{1},R_{2})\). \(\quad\) If it does not exist, \(\Delta\) aborts. \(\quad\)_Challenge_. At a certain stage, A issues a challenge tuple \((pk^{\#},\ m_{0},\ m_{1})\). If \(pk^{\#}\) is not the public key \(\Delta\) guessed in oracle \(\mathfrak{O}_{pk}\), \(\Delta\) declares failure and terminates. On the contrary, if \(pk^{\#}\) aligns with the guessed public key, \(\Delta\) responds by randomly selecting \(b\in\{0,1\}\) and choosing random numbers \(x_{1},\ x_{2},\ \alpha,\gamma\). \(\Delta\) then sets: \((g^{\prime},\ R_{1}=(g^{\prime})^{x_{1}a},\ R_{2}=(g^{\prime})^{x_{1}\cdot x_{ 2}k\cdot\gamma}.m_{b}^{3\cdot a\cdot\gamma})\). \(\quad\)_Phase 2_. \(\quad\)\(\mathfrak{O}_{pk}\): \(\Delta\) follows the Phase 1 response protocol. \(\mathfrak{O}_{sk}\): When provided with \(pk_{i}\), if \(pk_{i}=pk^{\#}\), or \((pk^{\#},\ pk_{i})\) is found in the table \(T_{rk}\), \(\Delta\) immediately terminates.