## 6 Safety Proof
: Given the challenger \(\mathcal{B}\), an instance \(W=(\Phi,g_{1},g_{1}^{a}A_{2},A_{3},g_{1}^{s}B_{2},U_{2})\) and a challenge item \(T\) (\(T=e(g_{1},g_{1})^{as}\) or \(T\in G_{2}\)). \(\mathcal{B}\) interacts with \(\mathcal{A}\) as follows. **Initialization. ** Let \(t\) indicate the maximum number of users. \(\mathcal{B}\) randomly selects \(g_{1},h_{1}\in G_{g_{1}}\), \(g_{3}\in G_{g_{3}}\), \(a_{1},a_{2},\ldots,a_{t},b\in Z_{N}\), and \(\alpha\in Z_{N}\). \(\mathcal{B}\) sets up \(u_{1}=g_{1}^{a_{1}},\ldots,u_{t}=g_{1}^{a_{t}},h_{1}=g_{1}^{b}\). \(\mathcal{B}\) selects a \((k,\varepsilon)\) strong binary extractor \(Ext:G_{2}\times Z_{N}\to G_{2}\). The public parameters are \(PP=\left\{N,Ext,g_{1},g_{3},h_{1},u_{1},\ldots,u_{t},e(g_{1},g_{1})^{\alpha}\right\}\). The master private key is \(MK=\left\{\alpha\right\}\). \(\mathcal{B}\) sends \(PP\) to \(\mathcal{A}\). **Stage 1. **\(\mathcal{A}\) asks for the private key of \(ID_{i}\in S\), where \(S=(ID_{1},\ldots,ID_{d})(d\leq t)\) is the intended receivers' collection. \(\mathcal{B}\) randomly selects \(\xi_{1},\xi_{2},\xi_{1},\xi_{2}\in Z_{N}\). Then, \(\mathcal{B}\) generates the semifunctional private key: \(\widetilde{SK_{ID_{i}}}=(\widetilde{SK_{ID_{i},k,1}},\widetilde{SK_{ID_{i},k,2 }})\), where \(\widetilde{SK_{ID_{i},k,1}}=(g_{1}^{r_{i}}R_{1}g_{1}^{\beta_{i}}(g_{2}^{a}g_{3}^ {\xi_{3}})^{\xi_{1}},g_{1}^{a}(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{r_{ i}}Q_{1}g_{1}^{\gamma_{i},k}(g_{2}^{a}g_{3}^{\xi_{3}})^{\xi_{2}})\) and \(\widetilde{SK_{ID_{i},k,2}}=(R_{1}^{\prime}g_{1}^{-\beta_{i},k}(g_{2}^{a}g_{3}^ {\xi_{3}})^{\xi_{1}},Q_{1}^{\prime}g_{1}^{-\gamma_{i},k}(g_{2}^{\mu}g_{3}^{\xi _{3}})^{\xi_{2}})\). \(\mathcal{B}\) responds to \(\mathcal{A}\) with the private key \(SK_{ID_{i}}\). **Challenge. **\(\mathcal{A}\) sends one challenge identity group \(S^{*}=\left\{ID_{1}^{*},\ldots,ID_{d}^{*}\right\}\) and two equal-length challenge messages \(M_{0}\) and \(M_{1}\) to \(\mathcal{B}\). \(\mathcal{B}\) randomly selects \(\beta\in\left\{0,1\right\}\) and calculates the ciphertext: \(\widetilde{CT}=(CM,Hd)=(CM,\widetilde{C_{1}},\widetilde{C_{2}},C_{3})=(M\oplus Ext (T,r),(g_{1}^{s}g_{2}^{a})^{\sum\limits_{j=1}^{d}\alpha_{j}ID_{j}+b},g_{1}^{s}g_ {2}^{a},r)\). **Stage 2. **\(\mathcal{A}\) continues to make a private key inquiry for \(ID_{i}\). The conditions that need to be met are \(ID_{i}\
otin S^{*}\). **Guess. **\(\mathcal{A}\) outputs a guess \(\beta^{\prime}\) about \(\beta\). If \(\beta^{\prime}=\beta\), \(\mathcal{A}\) wins the game. **Probability analysis. ** If \(T=e(g_{1},g_{1})^{as}\), \(\mathcal{B}\) correctly simulates the game GM\({}_{p}\). When \(T\in G_{2}\), \(\mathcal{B}\) correctly simulates the game GM\({}_{F}\). The joint distribution of all variables is represented by the symbol \(VD\). When there is no leakage, [69] shows that \(\widetilde{H}_{\infty}(\mathcal{A}|VD)\geq log_{2}^{N}\). Thus, the probability that the adversary receives the invalid ciphertext in every decryption query is \(2^{-\widetilde{H}_{\infty}(\mathcal{A}|VD)}\leq 2^{-log_{2}^{N}}=\frac{1}{30}\). When the symmetric key exposes \(l\) bits of information, we obtain \(\widetilde{H}_{\infty}(\mathcal{A}|(VD,Leak))\geq log_{2}^{N}-l\). Thus, the probability that the adversary receives the invalid ciphertext in every decryption query is \(2^{-\widetilde{H}_{\infty}(\mathcal{A}|(VD,Leak))}\leq 2^{-(log_{2}^{N}-l)}=\frac{2^{l}}{3}\). Therefore, the advantage of solving the difficult Hypothesis 3 using \(\mathcal{B}\) is \(\epsilon^{\prime}\geq\frac{2^{l}}{30}\varepsilon\). That is to say, if \(\mathcal{A}\) can distinguish GM\({}_{p}\) and GM\({}_{F}\) over advantage \(\varepsilon\), the challenger can destroy Hypothesis 3 with the advantage \(\epsilon^{\prime}\geq\frac{2^{l}}{N0}\varepsilon\). This contradicts Hypothesis 3. So, \(\left|AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{F}}(L_{K })\right|\leq\varepsilon\). Lemma 3 is proved. \(\square\)  
**Theorem 2**. : _The LR-SP-IBBE scheme has the performance of continuous leakage resilience._  
**Proof.