## 3 Construction
### Implementation
**Ciphertext generation**: \(\mathcal{B}\) first interacts with \(AT\) to generate the ciphertext \(CT_{A,T}\), and sends \(CT_{A,T}\) to \(\mathcal{A}\). The adversary has two ways to generate its own ciphertext:

**Case 1:** After the adversary (dishonest user) decrypts the ciphertext and obtains the plaintext \(M\), it regenerates the ciphertext \(CT^{\prime}\) by itself. This method is obviously not advisable, because even if the original decryption key of the ciphertext is generated, it is unable to decrypt \(CT^{\prime}\) and \(G_{T}(H(M))\) has been stored locally in the authority. **Case 2:** The adversary obtains the signature and generates the ciphertext by eavesdropping on the channel between the data owner and \(AT\), and sending information that is beneficial to \(\mathcal{A}\) to \(AT\); \(\mathcal{B}\) randomly selects \(s\xleftarrow{R}Z_{m}\), hashes the plaintext \(M\) and maps it to \(G_{T}\), \(\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as}\) and \(\overline{C_{0}},g^{s}\) are sent to \(\mathcal{A}\). The adversary \(\mathcal{A}\) attempts to generate a random number \(s^{{}^{\prime}}\) such that \(e(g,g)^{as^{{}^{\prime}}}=e(g,g)^{as}\), so he can send \(\overline{C_{0}^{\prime}}=G_{T}(H(M))\cdot e(g,g)^{as^{{}^{\prime}}}\), \(g^{s}\) and his own identity \(T^{\prime}\) to obtain the signature of \(AT\), and then according to \(Encrypt(PK_{AT},<A,\rho>,PK,M)\to CT_{A,T}\) algorithm to generate ciphertext and publishes it, \(\mathcal{A}\) can obtain \(g^{s}\) after eavesdropping on the channel, by calculating \(e(g,g^{s})\), he can get \(e(g,g)^{s}\), that is, the adversary \(\mathcal{A}\) knows \(e(g,g)^{s}\) and \(e(g,g)^{s}\), wants to calculate \(e(g,g)^{as}\). This is a \(CDH\) problem, there is no polynomial time algorithm to break it, so

\[G_{T}(H(M))=\overline{C_{0}}/e(g^{s},g^{s})\]0

\[G_{T}(H(M))=\overline{C_{0}}/e(g^{s},g^{s})\]1 Attack process and output results. ## 4 Experiments and Analysis

In this section, we mainly analyze the efficiency of our scheme and compared it with the Fully secure CP-ABE scheme proposed by [PERSON] et al. [33] in setup, key generation, encryption, decryption, and memory consumption. The experiment is in the win10, 16 GB, AMD Ryzen 5 R2600 Six-Core 3.40 GHz platform. We choose to use the JPBC library of JAVA to build the environment and generate a composite order group with a size of 512 bits and an integer cyclic group with a size of 258 bits through an 83-bit elliptic curve. The data were obtained by running the experiments on a locally set up environment and were saved in a text file in \".xlsx\" format. The figures were generated by comparing the data using MATLAB plotting. Figure 5 shows the setup comparison between our scheme and [PERSON] et al. 's scheme. Since the complexity of the setup is \(O(N)\) (\(N\) represents the number of attributes in the attribute universe), the time efficiency is almost the same except for computer errors. The master key is in the form of a key-value pair:

MSK:

alpha:210810353108659863024409106247517618452769941479846636980134442864523125

95818033429445987282464226795828802774079330

g3:5071237061826286107411154776484927021893929066858116887669480037266931236

6558956079248951460266712797586740186721012,3848333923503209101783513197106326

835379604308979589246948604032780415806659341351001892795149863403912326337017

537761,0

beta:3971351897302668818568847385425920497495147741445579066512932780617650627

24673043232946742579382079111050407589402

Figure 6 shows a comparison of the key generation time between our scheme and the scheme proposed by [PERSON] et al. Our scheme involves interactive key generation, resulting in higher overhead compared to [PERSON]'s scheme when the attribute space is small. However, as the attribute space grows, the performance gap between the two schemes decreases. \[G_{T}(H(M))=\overline{C_{0}}/e(g^{s},g^{s})\]2 Setup. Figure 7 illustrates a comparison of the encryption time between our scheme and the scheme proposed by [PERSON] et al. The ciphertext complexity of Allison et al.