## 4 Syntax and Security Description of CLR-SS-AIBBE
### Security Description of CLR-SS-AIBBE  
Our scheme is secure against the chosen ciphertext attack. The security of the **CLR-SS-AIBBE** scheme is described by the upcoming game \(\text{EX}_{\text{R}}\). In \(\text{EX}_{\text{R}}\), the challenger \(\mathcal{B}\) holds a list \(\mathcal{L}=\{(\mathcal{H},\mathcal{I},SK_{\text{L}},\mathcal{L}\mathcal{K}_{ 1},\mathcal{L}\mathcal{K}_{2})\}\), where \(\mathcal{H}\), \(\mathcal{I}\), \(\mathcal{K}\mathcal{K}\) and \(\mathcal{L}\mathcal{K}_{1},\mathcal{L}\mathcal{K}_{2}\) are the handle's space, the identity's space, the private key's space and the leakage space, respectively. Let \(\mathcal{H}=\mathbb{N}\) and \(\mathcal{L}\mathcal{K}_{1}=\mathcal{L}\mathcal{K}_{2}=\mathbb{N}\). The game \(\text{EX}_{\text{R}}\) is played by an adversary (or attacker), \(\mathcal{A}\), and a challenger, \(\mathcal{B}\). **Initialization:**\(\mathcal{B}\) calls the initialization algorithm to gain \(MP\) and \(MK\). \(\mathcal{B}\) sends \(MP\) to \(\mathcal{A}\). **Stage 1. **_An attacker can query these upcoming oracles._  
\(\mathcal{O}\)-\(Generate(ID)\). As for one identity \(ID\), \(\mathcal{B}\) finds its corresponding item in \(\mathcal{L}\). If one item is found out, the game is over. If no item is found out, \(\mathcal{B}\) runs **KeyGen** to obtain one private key \(SK_{ID}\) and updates the handle \(h\gets h+1\). Then, the challenger puts \((h,ID,SK_{ID},0,0)\) in \(\mathcal{L}\). \(\mathcal{O}\)-\(Leak(h,f_{1},f_{2})\). The attacker requires the leakage of the private key about the item \(h\). The attacker selects two leakage functions, \(f_{1}\) and \(f_{2}\). \(f_{1}\) and \(f_{2}\) input the private keys \(SK_{ID_{i},k,1}\) and \(SK_{ID_{i},k,2}\), respectively. \(\mathcal{B}\) sends the outputs of \(f_{1}\) and \(f_{2}\) to the adversary. Specifically, \(\mathcal{B}\) looks for one corresponding item about the handle \(h\). If one item \((h,ID,SK_{ID},L_{1},L_{2})\) is found out, \(\mathcal{B}\) determines whether \(L_{1}+|f_{1}(SK_{ID})|\leq L_{SK_{1}}\) and  
\(L_{2}+|f_{2}(SK_{ID})|\leq L_{SK_{2}}\), where \(L_{SK_{1}}\) and \(L_{SK_{2}}\) are the maximum values that allow the leakage of the private key. If \(L_{1}+|f_{1}(SK_{ID})|\leq L_{SK_{1}}\), the challenger will send \(f_{1}(SK_{ID})\) to the adversary and use \((h,ID,SK_{ID},L_{1}+|f_{1}(SK_{ID})|,L_{2})\) to update \((h,ID,SK_{ID},L_{1},L_{2})\). Otherwise, the challenger outputs \(\bot\). Similarly, if \(L_{2}+|f_{2}(SK_{ID})|\leq L_{SK_{2}}\), the challenger will send \(f_{2}(SK_{ID})\) to the adversary and use \((h,ID,SK_{ID},L_{1},L_{2}+|f_{2}(SK_{ID})|)\) to update \((h,ID,SK_{ID},L_{1},L_{2})\). Otherwise, the challenger outputs \(\bot\). Set \(L_{SK_{1}}=L_{SK_{2}}=L_{SK}\). \(\mathcal{O}\)-\(Reveal(h)\). If \(\mathcal{A}\) asks for a private key about one handle \(h\), \(\mathcal{B}\) looks for it in \(\mathcal{L}\). If the found item is \((h,ID,SK_{ID},L_{1},L_{2})\), the challenger sends \(SK_{ID}\) to \(\mathcal{A}\). \(\mathcal{O}\)-\(Refersh\). If an attacker enquires an updated private key about the handle \(h\), the challenger looks for it in \(\mathcal{L}\). If the found item is \((h,ID,SK_{ID},L_{1},L_{2})\), the challenger invokes **KeyUpd** to obtain the updated private key \(\widetilde{SK_{ID}}\). \(\mathcal{B}\) sends \(\widetilde{SK_{ID}}\) to \(\mathcal{A}\) and uses \((h,ID,\widetilde{SK_{ID}},0,0)\) to update \((h,ID,SK_{ID},L_{1},L_{2})\). \(\mathcal{O}\)-\(Decrypt1\). If the attacker asks for the corresponding plaintext of \((ID,CT)\), the challenger looks for \(SK_{ID}\) in \(\mathcal{L}\). The challenger runs \(\textbf{Decrypt}(MP,SK_{ID_{i},k,1},S,CT)\to CT^{\prime}\). If \(ID_{i}\in S\), the challenger calculates some parts \(CT^{\prime}\) of the plaintext and sends \(CT^{\prime}\) to \(\mathcal{A}\). \(\mathcal{O}\)-Decrypt2. If \(\mathcal{A}\) inquires about this plaintext of \((ID,CT)\), the challenger looks for \(SK_{ID}\) about \(ID\) in \(\mathcal{L}\). This challenger runs \(\mathbf{Decrypt2}(MP,SK_{ID,k,2},S,CT^{\prime})\to M\). First, \(CT\) is divided into \((C,Hdr)\).