# A Novel Dual Authenticated Encryption Scheme Suitable for Social Networking Services
## 4 Security Proof
### Security Proofs  
Based on previously defined security models, we formally prove the security of our DAE scheme in the security notion of IND-CCA2 and EF-CMA. **Theorem 1**. : **(Proof of Confidentiality)** _In the IND-CCA2 security notion, the proposed DAE scheme is said to be (\(t\), \(\varepsilon\))-secure if no probabilistic polynomial-time bounded adversary having a non-negligible advantage \(\varepsilon^{\prime}\) breaks BDHP within the time \(t^{\prime}\), where_  
\[\varepsilon^{\prime}\ \geq(\frac{1}{q_{h_{3}}})(2\varepsilon-\frac{q_{ADecrypt }}{2^{k}}),\]  
\[t^{\prime}\approx t+t_{\lambda}.\]  
_Here, \(t_{\lambda}\) represents the required time of executing all oracles._  
Proof. : It is assumed that in the security notion of IND-CCA2, there is a probabilistic polynomial-time adversary \(\mathcal{A}\) having a non-negligible advantage \(\varepsilon\) to break the proposed DAE scheme within the time \(t\). The capability of the adversary \(\mathcal{A}\) includes those stated in Definition 1 and \(h_{i}\) oracles (for \(i\) = 1, 2, and 3). Let \(q_{O}\) be the maximum times that \(\mathcal{A}\) is allowed to query for each oracle \(O\). The theorem is proven by the technique of contradiction, i.e., we will create a \((t^{\prime},\varepsilon^{\prime})\)-algorithm \(\mathcal{B}\) which utilizes the advantage of \(\mathcal{A}\) to break an BDHP instance of (\(P\), \(xP\), \(yP\), \(zP\)). The goal of the algorithm \(\mathcal{B}\) is to compute \(e(P,P)^{xyz}\). When \(\mathcal{A}\) submits an oracle query, \(\mathcal{B}\) also acts as a challenger to make a response. **Setup:** By initializing the Setup algorithm, the challenger \(\mathcal{B}\) returns the system's public parameters \(\{\)_G\({}_{1}\), \(\mathbf{G}_{2}\), \(q\), \(P\), \(e\)\(\}\) to the adversary \(\mathcal{A}\), who selects a target sender \(U_{a}\) and two participants \(U_{b}\) and \(U_{c}\) in the simulated three-party communication environment. **Phase 1:** The interactions between the adversary \(\mathcal{A}\) and the algorithm \(\mathcal{B}\) are described below. \(h_{1}\) _oracle:_ When \(\mathcal{A}\) submits a fresh \(h_{1}\) oracle on (\(m\), \(R\)), \(\mathcal{B}\) responds with an integer \(v_{1}\in_{R}Z_{q}\). The record (\(m\), \(R\), \(v_{1}\)) is also kept for future inspection. \(h_{2}\) _oracle:_ When \(\mathcal{A}\) submits a fresh \(h_{2}\) oracle on (\(R\), \(\sigma\), \(Z\)), \(\mathcal{B}\) responds with a vale \(v_{2}\in_{R}\{0\), \(1\}^{k}\). The record (\(R\), \(\sigma\), \(Z\), \(v_{2}\)) is also kept for future inspection. \(h_{3}\) _oracle:_ When \(\mathcal{A}\) submits a fresh \(h_{3}\) oracle on \(v_{3}\in\mathbf{G}_{2}\), \(\mathcal{B}\) responds with a vale \(V_{3}\in_{R}\mathbf{G}_{1}\). The record (\(v_{3}\), \(V_{3}\)) is also kept for future inspection. _Keygen oracle:_ When \(\mathcal{A}\) submits a fresh Keygen oracle on the index \(i\in(b\), \(c\)), \(\mathcal{B}\) directly returns either (\(yP\), \(\mathit{Cert}_{b}\)) for \(i\) = \(b\) or (\(zP\), \(\mathit{Cert}_{c}\)) for \(i\) = \(c\). Otherwise, \(\mathcal{B}\) submits a Keygen(\(i\)) oracle to get (\(x_{i}\), \(Y_{i}\), \(\mathit{Cert}_{i}\)) and then responds with (\(Y_{i}\), \(\mathit{Cert}_{i}\)). _AEncrypt oracle:_ When \(\mathcal{A}\) submits a fresh AEncrypt oracle on (\(m\), \(Y_{i}\), \(Y_{j}\), \(Y_{k}\)) where \(i\
ot\in\)(\(b\), \(c\)), \(\mathcal{B}\) responds with \(\delta\gets A\mathit{Encrypt}(m\), \(Y_{i}\), \(Y_{j}\), \(Y_{k}\)). Otherwise, \(\mathcal{B}\) aborts. _ADecrypt oracle:_ When \(\mathcal{A}\) submits a fresh ADecrypt oracle on \(\{\delta=(R\), \(\sigma\), \(r\)), \(Y_{i}\), \(Y_{j}\), \(Y_{k}\}\) where (\(j\), \(k\)) \(\
eq\) (\(b\), \(c\)), \(\mathcal{B}\) responds with \(ADecrypt(\delta\), \(Y_{i}\), \(Y_{j}\), \(Y_{k}\)). In case that (\(j\), \(k\)) = (\(b\), \(c\)), \(\mathcal{B}\) inspects all \(h_{2}\) oracle records containing the parameter (\(R\), \(\sigma\)).