# Proxy Re-Encryption Scheme for Decentralized Storage Networks
## 3 Preliminaries
### Proxy Re-Encryption  
We review the model of collusion-resilience PRE. A CCA collusion-resilience proxy re-encryption scheme is an algorithm:  
\[(KeyGen,RenKeyGen,Enc,ReEnc,Dec). \tag{6}\]  
\(KeyGen()\): The algorithm generates the public/secret key pair \((pk,sk)\). \(ReKeyGen(sk_{A},pk_{B})\): The re-encryption key generation algorithm accepts the secret key \(sk_{A}\) of [PERSON] and the public key \(pk_{B}\) of [PERSON]. It outputs a re-encryption key \(rk_{A\to B}\). \(Enc(sk,m)\): The encryption algorithm takes the public key \(sk\) and the clear message returns the encrypted message \(c\). \(ReEnc(rk_{A\to B},c_{A})\): The re-encryption algorithm transfers the encrypted message \(c_{A}\) into the ciphertext \(c_{B}\) using the re-encryption key \(rk_{A\to B}\). [PERSON]'s secret key can decrypt the transformed ciphertext \(c_{B}\). \(Dec(sk,c)\): The user decrypts the ciphertext with his secret key and encrypted \(c\), e.g., \(c_{A}\) or \(c_{B}\). It outputs the cleartext \(m\). Correctness is ensured for any \(m\in\mathcal{M}\) and any key pair of \((pk_{A},sk_{A})\), \((pk_{B},sk_{B})\), following the conditions Equations (7) and (8):  
\[Dec(sk_{A},Enc(sk_{A},m))=m, \tag{7}\]  
\[Dec(sk_{B},ReEnc(ReKeyGen(sk_{A},pk_{B}),Enc(sk_{A},m)))=m. \tag{8}\]  
Security definitionSecurity for a CCA collusion-resilience PRE scheme is defined in the game between an adversary \(\mathcal{A}\) and a challenger \(\mathcal{C}\). There are two ciphertexts from the cleartext message for the PRE scheme: encrypted cipher \(m\to c_{A}\) and re-encrypted \(m\to c_{B}\) are required for chosen-ciphertext security. **Phase 1. ** The adversary \(\mathcal{A}\) issues queries \(q_{1},\ldots,q_{m}\), of which \(q_{i}\) is one of the following:  
* Uncorrupted key generation query: The challenger \(\mathcal{C}\) computes \((pk_{i},sk_{i})\leftarrow KeyGen()\), and sends the \(pk_{i}\) to the adversary \(\mathcal{A}\). * Corrupted key generation query: The challenger \(\mathcal{C}\) computes \((pk_{j},sk_{j})\leftarrow KeyGen()\), and sends the \((pk_{j},sk_{j})\) to the adversary \(\mathcal{A}\). * Re-encryption key generation query: The challenger \(\mathcal{C}\) computes \(rk_{1\to 2}\leftarrow ReKeyGen(sk_{1},pk_{2})\), and sends the \(rk_{1\to 2}\) to the adversary \(\mathcal{A}\). Here, \(sk_{1}\) and \(pk_{2}\) must be from different key pairs. This query allows any key pair except that \(\mathcal{A}\) cannot know the value of \(sk_{1}\). * Re-encryption query: The challenger \(\mathcal{C}\) computes \(c_{2}\leftarrow ReEnc(rk_{1\to 2},c_{1})\), and sends the ciphertext \(c_{2}\) to the adversary \(\mathcal{A}\). * Decryption query: The challenger \(\mathcal{C}\) computes \(m\gets Dec(sk,c)\), and sends the cleartext \(m\) to the adversary \(\mathcal{A}\). Here, \(sk\) cannot be \(sk_{1}\) or \(sk_{2}\). **Challenge. ** After the adversary \(\mathcal{A}\) ends up Phase 1, \(\mathcal{A}\) chooses from two equal-length messages \(m_{0},m_{1}\in\mathcal{M}\), and sends to the challenger \(\mathcal{C}\). The challenger \(\mathcal{C}\) receives \(m_{0},m_{1}\). \(\mathcal{C}\) flips a random coin \(\delta\) Equation (9), and computes \(c\),  
\[\delta\leftarrow\{0,1\}, \tag{9}\]  
\[c\leftarrow Enc(sk_{A},m_{\delta}), \tag{10}\]  
then sends the \(c\) Equation (10) back to the adversary \(\mathcal{A}\). **Phase 2. ** The adversary \(\mathcal{A}\) continues to issue queries \(q_{m+1},\ldots,q_{max}\), which \(q_{i}\) can be one of the queries:  
* Uncorrupted key generation query: The challenger \(\mathcal{C}\) responses are the same as in Phase 1. * Corrupted key generation query: The challenger \(\mathcal{C}\) responses are the same as in Phase 1. * Re-encryption query: The challenger \(\mathcal{C}\) responses are the same as in Phase 1. * Decryption query: The challenger \(\mathcal{C}\) responses are the same as in Phase 1, except that \(c\
eq c_{A}\) and \(sk\
eq sk_{A}\), or \(c\
eq c_{B}\) and \(sk\
eq sk_{B}\). **Guess. ** The adversary \(\mathcal{A}\) outputs \(\delta\in\{0,1\}\).