# Proxy Re-Encryption Scheme for Decentralized Storage Networks
## 4 Proxy Re-Encryption Scheme
### Security Analysis
Algorithm \(\mathcal{B}\) calculates \(H_{3}(g^{d},E^{*})=H_{3}(g^{xy},E^{*})=F^{*}\oplus m_{\hat{\delta}}=\hat{\alpha}\). \(\mathcal{B}\) looks up the hash list \(H_{3}^{list}\) for the tuple \((g^{d},E^{*},\alpha)\) where \(\alpha=\hat{\alpha}\), then returns the \(g^{d}\) as the solution \(g^{xy}\) to the given mCDH instance. **Analysis. ** First, let us evaluate the simulation of random oracles. \(H_{1}\), \(H_{4}\) are perfect. As long as \(\mathcal{A}\) does not query \((m_{\delta},w)\) to \(H_{2}\) or \((g^{xy},E)\) to \(H_{3}\), so \(H_{2}\) and \(H_{3}\) are perfect. We denote \(AskH_{2}^{*}\) the event \((m_{\delta},w)\) has been queried to \(H_{2}\), and \(AskH_{3}^{*}\) the event that \((g^{xy},E)\) has been queried to \(H_{3}\). The challenged ciphertext is identically distributed. Second, the simulation for the re-encryption oracle. The re-encryption query is perfect unless the adversary \(\mathcal{A}\) can transfer the ciphertext into the new one without querying hash \(H_{1}\) to obtain the \(rk\). We denote this event as \(ReEncErr\). Since \(H_{1}\) plays the role of the random oracle, which is queried by adversary \(\mathcal{A}\) at most \(q_{re}\) times, we have  
\[\Pr[ReEncErr]\leq\frac{q_{re}}{q}. \tag{29}\]  
Third, the simulation for the decryption oracle. Suppose that \((pk,c),c=(D,r,E,F,V,S)\) is a valid ciphertext, as the validation \(S\stackrel{{? }}{{=}}V\cdot pk_{A}^{r}\) of ciphertext can be checked. There is still a chance that \(c\) can be generated by querying other random values to \(H_{3}\) instead of \(g^{d}\), where \(d=H_{1}(sk_{A},r)\). Denote \(Valid\) to be an event that \(c\) is valid. Let \(AskH_{3}\) be the event that \((g^{d},E)\) has been queried to \(H_{3}\) and \(AskH_{2}\) be the event that \((m,w)\) has been queried to \(H_{2}\). Then, we have \[ \begin{split}&\Pr[Valid|\
eg AskH_{2}]\\ =&\Pr[Valid\wedge AskH_{3}|\
eg AskH_{2}]\\ &+\Pr[Valid\wedge\
eg AskH_{3}|\
eg AskH_{2}]\\ \leq&\Pr[AskH_{3}|\
eg AskH_{2}]+\Pr[Valid|\
eg AskH_{3 }\wedge\
eg AskH_{2}]\\ \leq&\frac{q_{H_{3}}}{2^{l_{0}+l_{1}}}+\frac{1}{q}, \end{split}  \tag{30}\]  
similarly,  
\[ \begin{split}&\Pr[Valid|\
eg AskH_{3}]\\ =&\Pr[Valid\wedge AskH_{2}|\
eg AskH_{3}]\\ &+\Pr[Valid\wedge\
eg AskH_{2}|\
eg AskH_{3}]\\ \leq&\Pr[AskH_{2}|\
eg AskH_{3}]+\Pr[Valid|\
eg AskH_{2 }\wedge\
eg AskH_{3}]\\ \leq&\frac{q_{H_{2}}}{2^{l_{0}+l_{1}}}+\frac{1}{q}.\end{split}  \tag{31}\]  
Thus, we have  
\[ \begin{split}&\Pr[Valid|\
eg [PERSON]_{2}\vee\
eg [PERSON]_{3}]\\ &\leq\Pr[Valid|\
eg [PERSON]_{2}]+\Pr[Valid|\
eg [PERSON]_{3}]\\ \leq&\frac{q_{H_{2}}+q_{H_{3}}}{2^{l_{0}+l_{1}}}+ \frac{2}{q}.\end{split}  \tag{32}\]  
Denote \(DecErr\) as the event that \(Valid|(\
eg [PERSON]_{2}\vee\
eg [PERSON]_{3})\) happens during the entire simulation. The \(q_{d}\) times of decryption queries have been issued to a decryption oracle, and we have  
\[\Pr[DecErr]\leq\frac{(q_{H_{2}}+q_{H_{3}})q_{d}}{2^{l_{0}+l_{1}}}+\frac{2q_{d }}{q}. \tag{33}\]  
Denote \(Good\) as the event \(AskH_{3}^{*}\vee(AskH_{2}^{*}|\
eg AskH_{3}^{*})\lor ReEncErr\lor DecErr\). If \(Good\) has not happened, the adversary \(\mathcal{A}\) cannot gain any advantage in guessing \(\delta\) from \(m_{0},m_{1}\), due to the random \(E\) as one of the input of \(H_{3}(g^{d},E)\) and \(E=g^{e}=g^{H_{2}(m,w)}\) is generated with the random bits \(w\leftarrow\{0,1\}^{l_{1}}\). We have \(\Pr[\delta=\delta^{\prime}|\
eg Good]=\frac{1}{2}\)  
\[ \begin{split}&\Pr[\delta=\delta^{\prime}]\\ &=\Pr[\delta=\delta^{\prime}|\
eg Good]\Pr[\
eg Good]+\Pr[ \delta=\delta^{\prime}|Good]\Pr[Good]\\ &\leq\frac{1}{2}\Pr[\
eg Good]+\Pr[Good]\\ &=\frac{1}{2}(1-\Pr[Good])+\Pr[Good]\\ &=\frac{1}{2}+\frac{1}{2}\Pr[Good],\end{split}  \tag{34}\]  
and  
\[ \begin{split}\Pr[\delta&=\delta^{\prime}]\\ &\geq\Pr[\delta=\delta^{\prime}|\
eg Good]\Pr[\
eg Good]\\ &=\frac{1}{2}(1-\Pr[Good])\\ &=\frac{1}{2}-\frac{1}{2}\Pr[Good],\end{split}