# A Novel Dual Authenticated Encryption Scheme Suitable for Social Networking Services
## 4 Security Proof
### Security Model  
We first describe the critical security models of confidentiality and unforgeability for the proposed DAE scheme as follows:  
**Definition 1**.: **(Confidentiality)** _In adaptive chosen-ciphertext attacks, a DAE scheme fulfills confidentiality against indistinguishability (IND-CCA2) if there is no probabilistic polynomial-time bounded adversary \(\mathcal{A}\) having a non-negligible advantage in the following game played with a challenger \(\mathcal{B}\):_  
**Setup:** By initializing the Setup algorithm, the challenger \(\mathcal{B}\) will return the system's public parameters _params_ to the adversary \(\mathcal{A}\).  
**Phase 1:** To simulate the capability of the adversary \(\mathcal{A}\), we define three oracles that \(\mathcal{A}\) could issue and \(\mathcal{B}\) would respond with a consistent result.  
_Keygen oracle:_\(\mathcal{A}\) submits a Keygen oracle on an index \(i\) and \(\mathcal{B}\) responds with \((Y_{i},\mathit{Cert}_{i})\), i.e., \((Y_{i},\mathit{Cert}_{i})\)\(\leftarrow\)_Keygen_(\(i\)).  
_AEncrypt oracle:_\(\mathcal{A}\) submits an AEncrypt oracle on \((m,\)\(Y_{a},\)\(Y_{b},\)\(Y_{c})\), and \(\mathcal{B}\) responds with a corresponding authenticated ciphertext \(\delta\), i.e., \(\delta\)\(\leftarrow\)_AEncrypt\((m,\)\(Y_{a},\)\(Y_{b},\)\(Y_{c})\).  
_ADecrypt oracle:_\(\mathcal{A}\) submits an ADecrypt oracle on \((\delta,\)\(Y_{a},\)\(Y_{b},\)\(Y_{c})\). Then \(\mathcal{B}\) responds with either an error symbol \(\bot\) or the decrypted message \(m\) along with its signature \(\Omega\), i.e., \((\bot\) or \((m,\Omega))\)\(\leftarrow\)_ADecrypt_(\(\delta\), \(Y_{a},\)\(Y_{b},\)\(Y_{c})\).  
**Challenge:** The adversary \(\mathcal{A}\) sends \(\mathcal{B}\) two messages, \(m_{0}\) and \(m_{1}\), of the same length. The challenger \(\mathcal{B}\) will generate an authenticated ciphertext \(\delta^{\star}\) for \(m_{\lambda}\) which is determined by an internal flipped coin \(\lambda\)\(\leftarrow\)\(\{0,1\}\) and then return it to \(\mathcal{A}\) as a challenge.  
**Phase 2:** In this phase, the adversary \(\mathcal{A}\) is allowed to submit new oracles as those defined in Phase 1. However, any ADecrypt oracle containing the target ciphertext \(\delta^{\star}\) is prohibited.  
**Guess:** Finally, the adversary \(\mathcal{A}\) will output a bit \(\lambda^{\prime}\). When \(\lambda^{\prime}=\lambda\), we say that \(\mathcal{A}\) wins the game. Therefore, the advantage of \(\mathcal{A}\) in the above game could be expressed as \(\mathit{Adv}(\mathcal{A})=\mid\Pr[\lambda^{\prime}=\lambda]-1/2\mid\).  
**Definition 2**.: **(Unforgeability)** _In adaptive chosen-message attacks, a DAE scheme is existentially unforgeable (EF-CMA) if there is no probabilistic polynomial-time bounded adversary \(\mathcal{A}\) having a non-negligible advantage in the following game played with a challenger \(\mathcal{B}\):_  
**Setup:** By initializing the Setup algorithm, the challenger \(\mathcal{B}\) will return the system's public parameters _params_ to the adversary \(\mathcal{A}\).  
**Phase 1:** In this game, the capability of adversary \(\mathcal{A}\) includes Keygen and AEncrypt oracles which are defined the same as those of Definition 1.  
**Forgery:** After querying enough oracles, the adversary \(\mathcal{A}\) will arbitrarily choose a message \(m^{*}\) and forge its corresponding ciphertext \(\delta^{*}\). It is not allowed for \(\mathcal{A}\) to directly obtain \(\delta^{*}\) from any AEncrypt oracle. If the forged ciphertext \(\delta^{*}\) for \(m^{*}\) is valid, we say that the adversary \(\mathcal{A}\) wins the game.