## 6 Safety Proof
Thus, the probability that the adversary received the invalid ciphertext in every decryption query was \(2^{-\widetilde{H}_{\infty}(\mathcal{A}|VD)}\leq 2^{-log_{2}^{N}}=\frac{1}{30}\). When the symmetric key exposed \(l\) bits of information, we obtained \(\widetilde{H}_{\infty}(\mathcal{A}|(VD,\)\(Leak))\geq log_{2}^{N}-l\). Thus, the superiority that the adversary obtained in every decryption query was \(2^{-\widetilde{H}_{\infty}(\mathcal{A}|(VD,Leak))}\leq 2^{-(log_{2}^{N}-l)}=\frac{2^{l}}{N}\). Therefore, the advantage of solving the difficult Hypothesis 1 using \(\mathcal{B}\) is \(\epsilon^{\prime}\geq\frac{2^{l}}{N}\varepsilon\). That is to say, if \(\mathcal{A}\) could distinguish \(\text{GM}_{\rm R}\) and \(\text{GM}_{0}\) over advantage \(\varepsilon\), the challenger \(\mathcal{B}\) could destroy Hypothesis 1 with the advantage \(\epsilon^{\prime}\geq\frac{2^{l}}{N}\varepsilon\). This contradicts Hypothesis 1. So, \(\left|AD_{\mathcal{A}}^{\text{\rm GM}_{\rm R}}(L_{K})-AD_{\mathcal{A}}^{\text{ \rm GM}_{0}}(L_{K})\right|\leq\varepsilon\). \(\square\)  
**Lemma 2**. : _Considering that the symmetric key has \(l\) bits of leakage, if there is an adversary \(\mathcal{A}\) such that \(\left|AD_{\mathcal{A}}^{\text{\rm GM}_{\rm R-1}}(L_{K})-AD_{\mathcal{A}}^{\text{ \rm GM}_{\rm R}}(L_{K})\right|\geq\varepsilon\) (\(k\in(1,\ldots,p)\) ), the challenger \(\mathcal{B}\) destroys Hypothesis 2 with the advantage \(2^{l}\varepsilon\)._  
Proof. : Given the challenger \(\mathcal{B}\), an instance \(W=(\Phi,g_{1},A_{1}A_{2},A_{3},B_{2}B_{3})\) and \(T\) (\(T\in G_{q_{1}q_{3}}\) or \(T\in G_{1}\)). \(\mathcal{B}\) interacts with \(\mathcal{A}\) as follows:  
**Initialization. ** Let \(t\) indicate the maximum number of users. \(\mathcal{B}\) randomly selects \(g_{1},h_{1}\in G_{q_{1}},g_{3}\in G_{q_{3}}\), \(a_{1},a_{2},\ldots,a_{t},b\in Z_{N}\), and \(\alpha\in Z_{N}\). \(\mathcal{B}\) sets up \(u_{1}=g_{1}^{a_{1}},\ldots,u_{t}=g_{1}^{a_{t}}\), \(h_{1}=g_{1}^{b}\). \(\mathcal{B}\) selects a \((k,\varepsilon)\) strong binary extractor \(Ext:G_{2}\times Z_{N}\to G_{2}\). The public parameters are \(PP=\{N,Ext,g_{1},g_{3},h_{1},u_{1},\ldots,u_{t},e(g_{1},g_{1})\alpha\}\). The master private key is \(MK=\{\alpha\}\). \(\mathcal{B}\) sends \(PP\) to \(\mathcal{A}\). **Stage 1. **\(\mathcal{A}\) makes a private key inquiry for \(ID_{i}\in S\), where \(S=\{ID_{1},\ldots,ID_{d}\}\). \(\mathcal{B}\) responds in the following three ways:  
1. For \(i<k\), \(\mathcal{B}\) responds with the semifunctional key. \(\mathcal{B}\) randomly chooses \(\xi_{1},\xi_{2},\xi_{1},\xi_{2}\in Z_{N}\) and generates the semitunctional private key: \(\widetilde{SK_{ID_{i}}}=(\widetilde{SK_{ID_{i}}k,1},\widetilde{SK_{ID_{i}}k,2 })\) where \(\widetilde{SK_{ID_{i}}k,1}=(g_{1}^{r_{i}}R_{1}g_{1}^{\xi_{1}k}g_{2}^{\xi_{1}}, g_{1}^{a}(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})r_{i}Q_{1}g_{1}^{\tau_{i}k}g_{2}^{ \xi_{2}})\) and \(\widetilde{SK_{ID_{i}}k,2}=(R_{1}^{\prime}g_{1}^{-\beta_{i,k}}g_{2}^{\xi_{1}}, Q_{1}^{\prime}g_{1}^{-\tau_{i,k}}g_{2}^{\xi_{2}})\). 2. For \(i>k\), \(\mathcal{B}\) produces a normal private key in response. 3. For \(i=k\), \(\mathcal{B}\) randomly selects \(\beta_{i,k},\tau_{i,k}\in Z_{N}\), \(r_{i}\in Z_{N}(i=\{1,\ldots,d\})\), and \(R_{i},Q_{i},R_{i}^{\prime}\), \(Q_{i}^{\prime}\in G_{q_{3}}\). Then, \(\mathcal{B}\) generates a private key: \(SK_{ID_{i}k}\)\(=(SK_{ID_{i}k,1},SK_{ID_{i}k,2})\), where \(SK_{ID_{i}k,1}\)\(=(SK_{ID_{i}k,1}^{1},SK_{ID_{i}k,1}^{2})=(T^{\tau_{i}}g_{1}^{\xi_{1}k}R_{1},g_{1}^{ \alpha}(T^{\prime=1}\prod\limits_{j=1}^{d}g_{1}D_{j}+b)r_{i}g_{1}^{\tau_{i}k}Q _{1})\) and \(SK_{ID_{i}k,2}\) \(=(SK_{ID_{i}k,2}^{1},SK_{ID_{i}k,2}^{2})=(R_{1}^{\prime}g_{1}^{-\beta_{i,k}}, Q_{1}^{\prime}g_{1}^{-\tau_{i,k}})\). If \(T\in G_{q_{1}q_{3}}\), this private key has a normal form, \(\mathcal{B}\) correctly plays the game GM\({}_{k-1}\). If \(T\in G_{1}\), the private key has a semifitunctional form, \(\mathcal{B}\) correctly plays the game GM\({}_{k}\). **Challenge.