# Efficient and HRA Secure Universal Conditional Proxy Re-Encryption for Cloud-Based Data Sharing
## 5 Instantiation of Our Generic Construction
### Instantiation 1  
We suppose that the delegator is under the Elgamal encryption scheme denoted by \(\Pi_{f}\). That is, the delegator obtains a pair of keys \((\mathrm{sk}_{f},\mathrm{pk}_{f})\) through the algorithm \(\mathrm{KeyGen}(1^{\lambda})\) of \(\Pi_{f}\), we randomly choose \(s\in\mathbb{Z}_{p}^{s}\) and set have \(\mathrm{sk}_{f}=s\) and the public key \(\mathrm{pk}_{f}=h=g^{s}\). Meanwhile, the delegator generates the ciphertext \(\mathrm{ct}_{t}^{m}=(\mathrm{ct}_{f,1}^{m},\mathrm{ct}_{f,2}^{m})\) encrypting the plaintext \(m\) via exciting the algorithm \(\mathrm{Enc}(m,\mathrm{pk}_{f})\) of \(\Pi_{f}\), where \(\mathrm{ct}_{f,1}^{m}=g^{r}\) and \(\mathrm{ct}_{f,2}^{m}=h^{r}\cdot g^{m}\). Suppose that the delegatee is under the BBS encryption scheme denoted by \(\Pi_{t}\). In other words, the delegatee gets a pair of keys \((\mathrm{sk}_{t},\mathrm{pk}_{t})\) via the algorithm \(\mathrm{KeyGen}(1^{\lambda})\) of \(\Pi_{t}\), we set \(\mathrm{sk}_{t}=(x,y)\) and \(\mathrm{pk}_{t}=(f,h)\) where \(f=g^{x}\), \(h=g^{y}\), \(x,y\in\mathbb{Z}_{p}^{s}\). In our system, the proxy can transfer the ciphertext \(\mathrm{ct}_{t}^{m}\) encrypting the plaintext \(m\) under the Elgamal encryption scheme into the ciphertext \(\mathrm{ct}_{t}^{m}\) under the BBS encryption scheme, as described in the following procedure. * ReKeyGen \((1^{\lambda},\Pi_{f},\Pi_{t},\mathbf{pk}_{t},\mathbf{pk}_{t},\mathbf{sk}_{f}, \mathbf{ct}_{f}^{m})\rightarrow\mathbf{rk}_{f\to t}\): The delegator performs the algorithm \(\text{ReKeyGen}(1^{\lambda},\Pi_{f},\Pi_{t},\mathbf{pk}_{t},\mathbf{ct}_{f}^{m})\) to set the re-encryption key \(\mathbf{rk}_{f\to t}\) from the delegator to the delegate, where \(\mathbf{rk}_{f\to t}=(\mathbf{ct}_{f}^{mR},\mathbf{ct}_{t}^{R^{-1}}, \mathbf{hsk}_{f})\). First, the delegator sets the ciphertext \(\mathbf{ct}_{f}^{mR}\) encrypting the message \(mR\) by performing the algorithm \(\text{ScalMul}(\mathbf{pk}_{f},\mathbf{ct}_{f}^{m},R)\) of \(\Pi_{f}\). For the algorithm \(\Pi_{f}\), \(\text{ScalMul}\left(\mathbf{pk}_{f},\mathbf{ct}_{f}^{m},R\right)\), randomly choose \(R\in\mathbb{Z}_{p}^{*}\) and set \(\mathbf{ct}_{f,1}^{mR}=(\mathbf{ct}_{f,1}^{m})^{R}=g^{R}\),and \(\mathbf{ct}_{f,2}^{mR}=(\mathbf{ct}_{f,2}^{m})^{R}=(h^{r}\cdot g^{m})^{R}=h^{ rR}\cdot g^{mR}\), and returns \(\mathbf{ct}_{f}^{mR}=(\mathbf{ct}_{f,1}^{mR},\mathbf{ct}_{f,2}^{mR})\). Second, the delegator generates the ciphertext \(\mathbf{ct}_{t}^{R^{-1}}\) encrypting the message \(R^{-1}\) by executing the algorithm \(\text{Enc}(\mathbf{pk}_{t},R^{-1})\) of \(\Pi_{t}\). For the algorithm \(\Pi_{t}\), \(\text{Enc}(\mathbf{pk}_{t},R^{-1})\), randomly pick \(\alpha,\beta\in\mathbb{Z}_{p}^{*}\), and compute \(\mathbf{ct}_{t,1}^{R^{-1}}=f^{\alpha}\), \(\mathbf{ct}_{t,2}^{R^{-1}}=h^{\beta}\), and \(\mathbf{ct}_{t,3}^{R^{-1}}=g^{\alpha+\beta}\cdot R^{-1}\), and return \(\mathbf{ct}_{t}^{R^{-1}}=(\mathbf{ct}_{t,1}^{R^{-1}},\mathbf{ct}_{t,2}^{R^{-1 }},\mathbf{ct}_{t,3}^{R^{-1}})\). Third, we generate a hidden secret \(\mathbf{hsk}_{f}\) by executing the algorithm \(\text{HiddenSecret}(\mathbf{sk}_{f},\mathbf{ct}_{f}^{mR})\) of \(\Pi_{f}\). For the algorithm \(\Pi_{f}\), \(\text{HiddenSecret}(\mathbf{sk}_{f},\mathbf{ct}_{f}^{mR})\), we set \(\mathbf{hsk}_{f}=(\mathbf{ct}_{f,1}^{mR})^{s}=h^{rR}\) and return \(\mathbf{hsk}_{f}\). Finally, output \(\mathbf{rk}_{f\to t}=(\mathbf{ct}_{f}^{mR},\mathbf{ct}_{t}^{R^{-1}}, \mathbf{hsk}_{f})\). * ReEnc \((\Pi_{f},\Pi_{t},\mathbf{rk}_{f\to t})\rightarrow\mathbf{ct}_{f}^{m}\): The proxy performs the algorithm \(\text{ReEnc}(\Pi_{f},\Pi_{t},\mathbf{rk}_{f\to t})\) to generate re-encryption ciphertext \(\mathbf{ret}\), where \(\mathbf{ret}=\mathbf{ct}_{t}^{m}\). First, the proxy decrypts the ciphertext \(\mathbf{ct}_{t}^{mR}\) by executing the algorithm \(\text{Combine}(\mathbf{hsk}_{f},\mathbf{ct}_{f}^{mR})\) of \(\Pi_{f}\). For the algorithm \(\Pi_{f}\). \(\text{Combine}(\mathbf{hsk}_{f},\mathbf{ct}_{f}^{mR})\), the proxy sets \(g^{mR}=\mathbf{ct}_{f,2}^{mR}/\mathbf{hsk}_{f}\).