In the transformed proof, the challenger \(\mathcal{B}\) is thus given a 3-wDBDHI\({}_{3}\) instance \((g,A_{-1}=g^{1/a},A_{1}=g^{a},A_{2}=g^{(a^{2})},B=g^{b},\hat{g},\hat{A}_{-1}= \hat{g}^{1/a},\hat{A}_{1}=\hat{g}^{a},\hat{A}_{2}=\hat{g}^{(a^{2})},\)\(\hat{B}=\hat{g}^{b},Q)\in\mathbb{G}_{1}^{5}\times\mathbb{G}_{2}^{5}\times \mathbb{G}_{7}\) with unknown \(a,b\in\mathcal{Z}_{p}^{*}\), which is then used in the setup phase to provide the adversary \(\mathcal{A}\) with the public parameters \(u=A_{1}^{a_{1}}A_{2}^{\beta_{1}},v=A_{1}^{a_{2}}A_{2}^{\beta_{2}},\)\(w=A_{1}^{a_{3}}A_{2}^{\beta_{3}},\) and \(\hat{g}_{1}=\hat{A}_{2}^{a_{4}}\) for random \(\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4},\beta_{1},\beta_{2},\beta_{3} \stackrel{{\mathcal{S}}}{{\leftarrow}}\mathbb{Z}_{p}^{*}\), analogous to the proof of the base scheme. The majority of the proof of the base scheme can be transformed by making use of either \(A_{i}\) or \(\hat{A}_{i}\) according to the required group or by adjusting the positions of variables in a pairing to match the order of the source groups. However, in the proof of the base scheme both the re-encryption and the first-level decryption oracle recover \(K=e(g,\hat{g})^{r}\) by computing \(K=e(A_{-1},A_{1}^{r})\), where

\[A_{1}^{r}=\left(\frac{C_{4}}{C_{1}^{\frac{\beta_{1}+\beta_{2}+\beta_{3}}{ \beta_{0}}}}\right)^{\frac{1}{\alpha_{1}+\alpha_{2}+\alpha_{3}}}.\]

This is not feasible for the manually transformed scheme since \(C_{1}\in\hat{\mathbb{G}}_{2}\) and \(C_{4}\in\mathbb{G}_{1}\) are incompatible. Fortunately, there is an alternative approach to recovering \(K\) from \(C_{1}\) and \(C_{4}\), which leverages the bilinearity of the pairing \(e\) by computing

\[K=e(g,\hat{g})^{r}=\left(\frac{e(C_{4},\hat{A}_{-1})}{e(A_{-1},C_{1}^{\frac{ \beta_{1}+\beta_{2}+\beta_{3}}{\beta_{1}+\beta_{2}+\beta_{3}}}}\right)^{\frac{ 1}{\alpha_{1}+\alpha_{2}+\alpha_{3}}},\]

since

\[e(C_{4},\hat{A}_{-1}) =e((A_{1}^{a_{1}h+a_{2}l+a_{3}})A_{2}^{\beta_{1}h+\beta_{2}l+ \beta_{3}})^{r},\hat{A}_{-1})\] \[=e(g,\hat{g})^{r(a_{1}h+a_{2}l+a_{3})}e(g,\hat{g})^{ar(\beta_{1}h +\beta_{2}l+\beta_{3})}\]

and

\[e(A_{-1},C_{1}^{\frac{1}{\alpha_{4}}})=e(A_{-1},\hat{A}_{2}^{r})=e(g,\hat{g}) ^{ar}.\]The application of these adjustments allows for the transformation of both the chosen ciphertext security proofs at the first and second level of the base scheme to the Type 3 setting for the manually transformed scheme. ### Performance Evaluation

We compare the performance and ciphertext size of the schemes resulting from the automated transformation (Section 3.2) and the manual transformation (Section 4.1). To that end, we implemented the schemes using mcl-wasm ([[https://github.com/herumi/mcl](https://github.com/herumi/mcl)]([https://github.com/herumi/mcl](https://github.com/herumi/mcl)), (accessed on 1 March 2024) ) [7] with the BLS12-381 curve, roughly targeting the 128-bits security level [22]. As we can see in Table 1, the manually transformed scheme outperforms the automatically transformed scheme in decryption and re-encryption at the cost of slightly slower encryption and larger ciphertexts. This can be explained by the difference that the manual transformation chooses \(C_{1}\) to be in \(\hat{\mathbb{G}}_{2}\) instead of \(\hat{\mathbb{G}}_{1}\) as in the automated transformation. This leads to the fact that the manually transformed scheme performs more computations in \(\hat{\mathbb{G}}_{2}\) for the encryption, whereas the automatically transformed scheme carries this out in the ciphertext validation, which is required when re-encrypting and decrypting. Since in the Type 3 setting \(\hat{\mathbb{G}}_{2}\) is usually defined over an extension field, group operations are slower in \(\hat{\mathbb{G}}_{2}\) than in \(\hat{\mathbb{G}}_{1}\). Furthermore, due to this fact, the representation of group elements of \(\hat{\mathbb{G}}_{2}\) is larger than in \(\hat{\mathbb{G}}_{1}\), leading to the slightly larger ciphertext sizes.