# Proxy Re-Encryption Scheme for Decentralized Storage Networks
## 4 Proxy Re-Encryption Scheme
### Proposed Scheme  
**Setup**  
In the CCA-secure and collusion-resilience PRE scheme, \(g\) is the generator of a cyclic multiplicative group \(\mathbb{G}\) of prime order \(p\). \(sk_{A}\) Equation (16) is the secret key and \(pk_{A}\) Equation (15) is the public key of [PERSON]. \(sk_{B}\) Equation (18) is the secret key and \(pk_{B}\) Equation (17) is the public key of [PERSON].  
\(m\) is the clear message of \(l_{0}\) bits length in the binary message space denoted by \(\mathcal{M}\). \(w\) is the random bits of \(l_{1}\) length. \(H\) is the hash function, where \(H_{1}:\mathbb{Z}_{p}\cdot\mathbb{Z}_{p}\rightarrow\mathbb{Z}_{p}\), \(H_{2}:\{0,1\}^{l_{0}}\cdot\{0,1\}^{l_{1}}\rightarrow\mathbb{Z}_{p}\), \(H_{3}:\mathbb{G}^{2}\rightarrow\{0,1\}^{l_{0}+l_{1}}\), \(H_{4}:\mathbb{G}\cdot\{0,1\}^{l_{0}+l_{1}}\rightarrow\mathbb{Z}_{p}\).  
\(KeyGen()\): The key generation algorithm generates the public/secret key pair \((pk,sk)\) for the user:  
\[a,b\in\mathbb{Z}_{p}, \tag{14}\] \[pk_{A}=g^{a},\] (15) \[sk_{A}=a,\] (16) \[pk_{B}=g^{b},\] (17) \[sk_{B}=b. \tag{18}\]\(ReKeyGen(sk_{A},pk_{B})\): The re-encryption-key-generating algorithm accepts the secret key \(sk_{A}\) from [PERSON] and the public key \(pk_{B}\) from [PERSON]. The algorithm returns the re-encryption key \(rk_{A\to B}\).  
Re-key \(rk_{A\to B}=(\frac{pk_{B}}{pk_{A}})^{d}=(\frac{s^{b}}{g^{a}})^{d}=g^{ bd-ad}\), where the \(pk_{A}\) can be derived from \(sk_{A}\). When re-encrypting \(D_{B}=D_{A}\cdot rk_{A\to B}=(g^{a})^{d}\cdot g^{bd-ad}=g^{bd}\), the re-key can only be issued by [PERSON], who knows \(d=H_{1}(sk_{A},r)\).  
\(Enc(sk_{A},m)\): The encryption algorithm takes the secret key \(sk_{A}\), and the clear message \(m\) returns the encrypted message \(c_{A}\) via Equation (19):  
\[(m||w)\stackrel{{ Enc}}{{\longrightarrow}}c_{A}=\langle D_{A},r, E,F,V,S\rangle. \tag{19}\]  
where \(D,r,E,F,V,andS\) are defined as Equations (20)-(24):  
\[D_{A}=(pk_{A})^{d},d=H_{1}(sk_{A},r),r\leftarrow\mathbb{Z}_{p}, \tag{20}\]  
\[E=g^{e},e=H_{2}(m,w),w\leftarrow\{0,1\}^{l_{1}}, \tag{21}\]  
\[F=H_{3}(g^{d},E)\oplus(m||w), \tag{22}\]  
\[V=g^{v},v\leftarrow\mathbb{Z}_{p}, \tag{23}\]  
\[S=g^{s},s=v+sk_{A}\cdot r. \tag{24}\]  
\(ReEnc(rk_{A\to B},c_{A})\): The re-encryption algorithm transfers the encrypted message \(c_{A}\) into the ciphertext \(c_{B}\) using the generated re-encryption key \(rk_{A\to B}\) via Equation (25). [PERSON]'s secret key can decrypt the transformed ciphertext \(c_{B}\). Here, \(d\) is used to generate the permission of delegation. Only the content owner can create new \(D\) or \(rk\) with \(sk_{A}\) and \(r\).  
Before the transferring, the validation \(S\stackrel{{?}}{{=}}V\cdot pk_{A}^{r}\) of ciphertext should be checked to ensure Alice generates the ciphertext. Otherwise, the algorithm outputs \(\bot\):  
\[\begin{split} c_{A}\stackrel{{ ReEnc}}{{\longrightarrow}}c_{B}& =\langle D_{B},r,E,F,V,S\rangle\\ &=\langle D_{A}\cdot rk_{A\to B},r,E,F,V,S\rangle.\end{split} \tag{25}\]  
\(Dec(sk,c)\): The user decrypts the ciphertext with his secret key and encrypted \(c\), e.g., \(c_{A}\) or \(c_{B}\). It outputs the cleartext \(m\) and random bits \(w\) via Equation (26). After decryption, the validation of ciphertext should be checked \(E\stackrel{{?}}{{=}}g^{H_{2}(m,w)}\). If not, the algorithm outputs \(\bot\):  
\[\begin{split} c_{B}\stackrel{{ Dec}}{{\longrightarrow}}(m||w)& =F\oplus H_{3}(g^{d},E),g^{d}=D_{B}^{\frac{1}{4B}}\\ &=F\oplus H_{3}(D_{B}^{\frac{1}{4B}},E).\end{split} \tag{26}\]  
In WDLC10 [7], CCA-secure \"hashed\" ElGamal and modified version is used. The textbook ElGamal is CPA-secure and risky in the rounded attack. To enhance the security, \"hashed\" ElGamal is applied with a message authenticated mechanism.