# Efficient and HRA Secure Universal Conditional Proxy Re-Encryption for Cloud-Based Data Sharing
## 2 Preliminaries
### Hidden Secret Decryption  
The encryption schemes used in the UCPRE have a vital character that supports hidden secret decryption. Hidden secret decryption means that these encryption schemes are provided with a algorithm **Hidden Secret** denoted by \((\mathrm{hsk})\leftarrow\textbf{HiddenSecret}(\mathrm{sk},\mathrm{ct})\), which works as follows: it inputs a secret key \(\mathrm{sk}\) and the ciphertext \(\mathrm{ct}\) encrypting \(m\), and outputs a hidden secret \(\mathrm{hsk}\), such that the semitrusted third party (e.g., cloud server) with the hidden secret key \(\mathrm{hsk}\) can decrypt the ciphertext \(\mathrm{ct}\) encrypting the message \(m\). In other words, these schemes exist an algorithm **Combine** denoted by \((m,\bot)\leftarrow\textbf{Combine}(\mathrm{hsk},\mathrm{ct})\) if they are equipped with the algorithm **Hidden Secret**. The algorithm **Combine** works as follows: it inputs the hidden secret \(\mathrm{hsk}\) and the ciphertext \(\mathrm{ct}\), and outputs the message \(m\) or a symbol \(\bot\). In our UCPRE, we can take the hidden secret as a condition. When the semitrusted third party holds the condition \(\mathrm{hsk}\) about the message \(m\), it means that the semitrusted third party can decrypt the ciphertext \(\mathrm{ct}\) encrypting \(m\) without obtaining information about another message \(m^{\prime}\) encrypted by the secret key \(\mathrm{sk}\). In UCPRE, the delegator performs the algorithm **HiddenSecret** to set the hidden secret key \(\mathrm{hsk}\) and shares it with the proxy so that the proxy decrypts the ciphertext \(\mathrm{ct}^{\prime}\) encrypting \(mR\) by executing the algorithm **Combine**. This is because, in our context, the proxy does not decrypt the plaintext because it is disguised by a random element. Encryption schemes such as Elgamal [31], the extension of Elgamal [32] or RSA [33], satisfy all these properties. **The Elgamal Encryption**. The Elgamal encryption [31] is homomorphic encryption scheme that is practical and universal in actual applications. In Section 5, we will employ an additive variation of the Elgamal for small domains plaintext space. Here we show the implementation of this scheme. By executing the algorithm \(\mathrm{Setup}\big{(}1^{\lambda}\big{)}\) to generate the public parameter \(\mathrm{Par}=(\mathbb{G},p,g)\), where a generator \(g\) of multiplicative cyclic group \(\mathbb{G}\) of prime order \(p\). We randomly select \(s\in\mathbb{Z}_{p}^{*}\) and compute \(g^{s}\), and then set the secret key \(\mathrm{sk}=s\) and the public key \(\mathrm{pk}=g^{s}\). Encryption is executed by selecting \(r\leftarrow\mathbb{Z}_{p}^{*}\) and setting \(\mathrm{ct}=(\alpha,\beta)\), where \(\alpha=g^{r}\) and \(\beta=h^{r}\cdot g^{m}\). Decryption of a ciphertext \(\mathrm{ct}=(\alpha,\beta)\) is performed by computing \(g^{m}=\beta/\alpha^{s}\). Then, the message \(m\) is retrieved through running an exhaustive search. **The Elgamal PKE with Hidden Secret Decryption**. Setup, KeyGen, and Enc algorithms are the same as the above description of the Elgamal encryption. In our system, the user generates the hidden secret \(\mathrm{hsk}=\alpha^{s}\) by the algorithm \(\mathrm{SecretHidden}(\mathrm{pk},\mathrm{sk},\mathrm{ct})\) and sends it to the semitrusted third party. Finally, decryption of a ciphertext \(\mathrm{ct}=(\alpha,\beta)\) is executed by computing \(g^{m}=\beta/\mathrm{hsk}\). Then, the message \(m\) is retrieved through running an exhaustive search. **The BBS Encryption**. The BBS encryption [32] is multiplicatively homomorphic encryption that can be viewed as an extension of the Elgamal encryption. In Section 5, we will instantiate our generic construction UCPRE by transferring the ciphertext under the Elgamal encryption scheme into the ciphertext under the BBS encryption scheme. Here we show the implementation of this scheme.