## 5 Security  
### Security Proof  
Our CLAP-PRE scheme in Section IV is IND-CLAPPRE-CPA secure under the \(k\)-MDDH assumption in the random oracle model. Proof. : Suppose \(\mathcal{A}\) can break our CLAP-PRE scheme with the non-negligible advantage \(\epsilon\) in polynomial time in Section IV. There must another adversary \(\mathcal{B}\) that can break the \(k\)-MDDH assumption with a non-negligible advantage by interacting with \(\mathcal{A}\). Adversary \(\mathcal{B}\) accepts a tuple \((\mathcal{S}_{1},\mathcal{S}_{1}^{a},\mathcal{S}_{1}^{b},\mathcal{S}_{1}^{c}, \mathcal{S}_{1}^{d},\mathcal{S}_{1}^{e},\mathcal{S}_{1}^{d},\mathcal{S}_{1}^{e },\mathcal{S}_{1}^{e},\mathcal{S}_{1}^{d})\) as input. We say that the tuple \((\mathcal{S}_{1},\mathcal{S}_{1}^{a},\mathcal{S}_{1}^{b},\mathcal{S}_{1}^{c}, \mathcal{S}_{1}^{d},\mathcal{S}_{1}^{e},\mathcal{S}_{1}^{d},\mathcal{S}_{1}^{ e},\mathcal{S}_{1}^{a})\) is a \(k\)-MDDH instance. \(\mathcal{B}\) outputs \(1\) which indicates \(T=g_{4}^{abcde}\); otherwise, \(\mathcal{B}\) outputs \(0\). In order to simplify the proof of the scheme, we use the techniques proposed in [25; 26] to construct our \(\mathcal{O}_{pk}(ID_{i})\) and \(\mathcal{O}_{sk}(ID_{i})\). \(\mathcal{B}\) interacts with adversary \(\mathcal{A}\) in the IND-CLAPPRE-CPA game as follows:  
* SETUP. \(\mathcal{B}\) runs \(PairGen(1^{\lambda})\) and gives the system's parameters \(par=(q,G_{1},G_{2},G_{3},G_{4},\)\(e_{ij},g_{i},A=e(\mathcal{S}_{1}^{a},\mathcal{S}_{1}^{b})=g_{2}^{ab},u_{1}=g_{1}^{f},B=e(u_{1},g_{ 1}^{c}),H_{1})\), \(f\in_{R}Z_{q}^{*}\) to the adversary \(\mathcal{A}\). The master secret key is \(ab\) which is unknown to \(\mathcal{B}\). ;* FIND PHASE. In this phase, adversary \(\mathcal{A}\) issues some queries, and \(\mathcal{B}\) answers these queries as follows:
* First, \(\mathcal{B}\) takes \(ID^{*}\leftarrow\{ID_{1},ID_{2},\,\ldots,\,ID_{n}\}\) at random. Adversary \(\mathcal{B}\) guesses that \(ID^{*}\) would be challenged by adversary \(\mathcal{A}\) in the following phase;
* On a \(\mathcal{O}_{pk}(ID_{i})\) query, \(\mathcal{B}\) first randomly selects \(x_{i},y_{i}\in Z_{q}^{*}\). If \(ID_{i}=ID^{*}\), \(\mathcal{B}\) sets \(H_{1}(ID_{i})=g_{1}^{y_{i}/f}\), \(X=g_{2}^{dx_{i}}=e(g_{1},g_{1}^{d})^{x_{i}}\) and \(Y=B^{dx_{i}}=e(u_{1},g_{1}^{c})^{dx_{i}}=e(g_{1}^{d},g_{1}^{c})^{fx_{i}}\). In this case, the user's private key is \(\{B^{ab}e(u_{1},H_{1}(ID_{i}))^{r},g_{2}^{r},dx_{i}\}\), which is unknown to \(\mathcal{B}\). Otherwise, \(\mathcal{B}\) sets \(H_{1}(ID_{i})=g_{1}^{c}g_{1}^{y_{i}/f}\), \(X=g_{2}^{x_{i}}\) and \(Y=B^{x_{i}}\).In this case, \(\mathcal{B}\) does not know the user's private key;
* On a \(\mathcal{O}_{pa}(ID_{i})\) query, for the initial query of identity \(ID_{i}\), \(\mathcal{B}\) creates a delegation path for \(ID_{i}\) and gives it to the adversary. Otherwise, \(\mathcal{B}\) returns \(\bot\);
* On a \(\mathcal{O}_{sk}(ID_{i})\) query, if \(ID_{i}=ID^{*}\), \(\mathcal{B}\) aborts. Otherwise, \(\mathcal{B}\) computes \[e(u_{1},H_{1}(ID_{i}))^{r} =(Bg_{2}^{y_{i}})^{r}\] \[=B^{ab}B^{-ab}(Bg_{2}^{y_{i}})^{r-ab}\] \[B^{ab}(Bg_{2}^{y_{i}})^{r-ab} =A^{-y_{i}}e(u_{1},H_{1}(ID_{i}))^{r}\] \[g_{2}^{r-ab} =g_{2}^{r}A^{-1}\] and gives them and \(x_{i}\) to the adversary;
* On a \(\mathcal{O}_{rk}(ID_{i})\) query, if \(ID_{i}\
eq ID^{*}\), this means adversary \(\mathcal{B}\) knows the user's private key, and \(\mathcal{B}\) runs \(RKGen(par,Pa_{ID_{i}})\) to generate re-encryption keys. If \(ID_{i}=ID^{*}\), this means adversary \(\mathcal{B}\) does not know the user's private key, and \(\mathcal{B}\) computes the re-encryption key \(rk^{ID_{i}}\) as follows:
* \(\mathcal{B}\) selects \(Z_{1},\,\ldots,\,Z_{ID_{i}}\leftarrow_{R}G_{1}\);
* \(\mathcal{B}\) sets \(rk^{0\bot}_{ID_{i}}=Z_{1}\). Note that adversary \(\mathcal{A}\) can not distinguish the real view and simulated view, because \(rk^{0\bot 1}_{ID_{i}}=H_{1}(ID_{1})^{SK_{ID_{3}}}\in G_{1}\);
* \(\mathcal{B}\) sets \(rk^{j\bot j+j+1}_{ID_{i}}=\frac{Z_{j+1}}{Z_{j}}\).