# Proxy Re-Encryption Scheme for Decentralized Storage Networks
## 5 Experiment
### Practical Implementation  
Due to the computation inefficiency of ECC, in the practical implementation, we can use elliptic curves and cyclic multiplicative group together to boost the encryption.  
For the practical encryption and decryption, the message is divided into small chunks \(m\), as each time that group operation is involved in the computation, using ECC will cost much longer time. For the calculation \(F=H_{3}(g^{d},E)\oplus(m||w)\), where \(E=g^{e},e=H_{2}(m,w),w\leftarrow\{0,1\}^{l_{1}}\), the operation \(E=g^{e}\) will be too expensive if using ECC. On the other hand, ECC provides better security with less secret key length in bits for the user's public key and secret key. Roughly speaking, 160 bits of the ECC secret key are as strong as 1024 bits of the secret key required in RSA or ElGamal over the multiplicative integer group.  
It is better to divide and conquer the problem by using both the elliptic curves group and the cyclic multiplicative integer group \(g\in\mathbb{G}_{p}\). In the calculation \(D_{A}=(pk_{A})^{d},d=H_{1}(sk_{A}r),r\leftarrow\mathbb{Z}_{p}\), for the user key pair \((pk,sk)\), we use generator \(g_{ECC}\in\mathbb{G}_{ECC}\), then \(pk=g_{ECC}^{sk}\). Meanwhile \(F=H_{3}(g^{d},E)\oplus(m||w)\) the exponential operation \(g^{d}\) in \(H_{3}\) can be calculated only once in ECC and cached. Another exponential calculation \(E=g^{e}\) must be evaluated for every \(m\) and \(w\). Thus, for \(g^{e}\), the ECC operation will be too heavy. Here, we have the modification below:  
\[(m||w)\xrightarrow{Enc}c_{A}=\langle D_{A},r,E,F,V,S\rangle. \tag{41}\]  
where \(D,r,E,F,V,S\) is defined as:  
\[D_{A}=(pk_{A})^{d},d=H_{1}(sk_{A},r),r\leftarrow\mathbb{Z}_{p}, \tag{42}\]  
\[E=g^{e},e=H_{2}(m,w),w\leftarrow\{0,1\}^{l_{1}}, \tag{43}\]  
\[F=H_{3}(g_{ECC}^{d},E)\oplus(m||w), \tag{44}\]  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Schemes** & **Shao09** & **WDLC10** & **Ours** \\ \hline \multirow{4}{*}{Compute Cost} & ReKenGen & \(2t_{eN}\) & \(t_{e}\) & \(t_{e}\) \\ \cline{2-5}  & Enc & \(5t_{eN}\) & \(3t_{e}\) & \(5t_{e}\) \\ \cline{2-5}  & Dec & \(4t_{eN}\) & \(3t_{e}\) & \(2t_{e}\) \\ \cline{2-5}  & ReEnc & \(5t_{eN}\) & \(3t_{e}\) & \(N/A\) \\ \hline \multirow{2}{*}{Ciphertext Size} & 1 st level & \(2k+3|N_{x}^{2}|+|m|\) & \(3|\mathcal{G}|\) & \multirow{2}{*}{\(4|\mathcal{G}|+|m|+|w|\)} \\  & 2 nd level & \(k_{1}+3|N_{x}^{2}|+2|N_{y}^{2}|+|m|\) & \(3|\mathcal{G}|+|\mathbb{Z}_{q}|\) & \\ \hline \multirow{4}{*}{Security} & Security Level & collusion resistant, CCA & collusion resistant, CCA & collusion resistant, CCA \\ \cline{2-5}  & Standard model & Yes & Yes & Yes \\ \cline{1-1} \cline{2-5}  & Underlying Assumptions & DDH & CDH & CDH \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison with Shao09 and WDLC10.  
\[V=g_{ECC}^{v},v\leftarrow\mathbb{Z}_{p}, \tag{45}\]  
\[S=g_{ECC}^{s},s=v+sk_{A}\cdot r. \tag{46}\]  
For the re-encryption \(c_{A}\xrightarrow{ReEnc}c_{B}\), re-encrypting \(D_{B}=D_{A}\cdot rk_{A\to B}=(g_{ECC}^{d})^{d}\cdot g_{ECC}^{bd-ad}=g_{ECC}^{ bd}\), where re-key \(rk_{A\to B}=(\frac{pk_{B}}{pk_{A}})^{d}=(\frac{g_{ECC}^{d}}{g_{ECC}^{s}})^{d}=g_{ECC}^{ bd-ad}\). For the validation \(E\xrightarrow{?}g^{H_{2}(m,w)}\) after decryption, as \(pk\) is not involved, no ECC operation needs to be performed.