## 6 Proof of Safety  
**Theorem 1**. : _Suppose that Assumption 1, Assumption 2 and Assumption 3 hold, and the leakage amount of the private key does not exceed \(L_{SK_{1}}=L_{SK_{2}}=(1-2\Lambda)\theta\) bits, where \(\theta=\log_{2}^{u_{2}}\), and \(\Lambda\) is a small constant number; the proposed CLR-SS-AIBBE scheme is CCA secure under the standard model, where \(L_{SK_{1}}=L_{SK_{2}}=L_{SK}\)._  
The main ideal of the proof. The indistinguishability of a series of games expounds its security of the given scheme. \(\text{EX}_{\text{R}}\) is a real security game, and the rest of the games are gradually changed from \(\text{EX}_{\text{R}}\). In \(\text{EX}_{\text{F}}\), any attacker has no advantage. As long as it is proven that the adversary cannot distinguish between two consecutive games, security is achieved. \(q\) denotes the maximum number of private key queries. \(\text{EX}_{\text{R}}\): It is the real security game of CLR-SS-AIBBE. \(\text{EX}_{0}\): It is very similar to \(\text{EX}_{\text{R}}\). The only difference is that \(\text{EX}_{0}\) has semi-functional ciphertext. \(\text{EX}_{\text{i}}\) (\(i\in[1,q]\)): The challenger responds to \(\mathcal{A}\) with a semi-functional ciphertext, responds to \(\mathcal{A}\)'s previous \(i\) private key inquiries with semi-functional ones and responds to the other private key queries with normal ones. Supposing \(i=q\) (\(\text{EX}_{\text{q}}\)), the challenger generates semi-functional private keys to respond to all private key queries. \(\text{EX}_{\text{F}}\). The only difference between \(\text{EX}_{\text{q}}\) and \(\text{EX}_{\text{F}}\) is that in \(\text{EX}_{\text{F}}\), \(\mathcal{B}\) encrypts a message randomly, while in \(\text{EX}_{\text{q}}\), \(\mathcal{B}\) only encrypts one of the two given challenge messages. Table 2 shows the types of the ciphertext and the private key for every game. The ciphertext or the private key represented by SMF is semi-functional. We use NM to indicate that one ciphertext or one private key is normal. The types for the ciphertext and the private key are represented by \(\text{TY}_{\text{SK}}\) and \(\text{TY}_{\text{CT}}\), respectively. \((\underbrace{(\text{TY}_{\text{CT}},\text{TY}_{\text{SK}}),\ldots,(\text{ TY}_{\text{CT}},\text{TY}_{\text{SK}})}_{\text{q}})\) indicates the corresponding type of the private keys and the ciphertexts of the \(q\) inquiries in one game. Since the ciphertext has the same form in every query, \((\underbrace{(\text{TY}_{\text{CT}},\text{TY}_{\text{SK}}),\ldots,(\text{ TY}_{\text{CT}},\text{TY}_{\text{SK}})}_{\text{q}})\) can be abbreviated as \((\text{TY}_{\text{CT}},\underbrace{\text{TY}_{\text{SK}},\ldots,\text{TY}_{ \text{SK}}}_{\text{q}})\). **Proof. ** We will complete the proof through \(\text{EX}_{\text{R}}\), \(\text{EX}_{\text{i}}\) (\(i\in(0,1,\dots,q)\)) and \(\text{EX}_{\text{F}}\) and four lemmas. Lemma 1 gives the limit of leakage. The other three lemmas prove the indistinguishability of these games. Moreover, the advantage gained by the attacker in the game \(\text{EX}_{\text{F}}\) is proven to be negligible. Table 3 illustrates the distinctions for the superiority achieved by the attacker between two consecutive games. Here, we give the conclusions of Lemma 2, Lemma 3 and Lemma 4. Their proofs will be given later. \(Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}\) or \(Adv_{\mathcal{A}}^{\text{Ex}_{\text{R}}}(L_{SK})\) is used to indicate the superiority achieved by \(\mathcal{A}\) in this game \(\text{EX}_{\text{R}}\). We use \(Adv_{\mathcal{A}}^{\text{EX}_{\text{R}}^{\text{or}}}\) or \(Adv_{\mathcal{A}}^{\text{EX}_{\text{i}}}(L_{SK})\) to indicate the superiority achieved by \(\mathcal{A}\) in this game \(\text{EX}_{\text{i}}\) (\(i\in(0,\dots,q)\)). We use \(Adv_{\mathcal{A}}^{\text{Ex}_{\text{F}}}\) or \(Adv_{\mathcal{A}}^{\text{Ex}_{\text{F}}}(L_{SK})\) to indicate the superiority achieved by \(\mathcal{A}\) in this game \(\text{EX}_{\text{F}}\). From Table 3, the following fact can be obtained. \[