## 2 Related Work and Our Motivations  
### Linkage-Resilient Cryptography  
Leakage-resilient (LR) cryptosystems are the cryptographic systems that are secure against side-channel attacks. The attack capability depends on specific limitations, which are usually abstracted as a leak function in the security model. According to different restrictions on the leakage function, the current leakage-resilient cryptography models are mainly as follows. (1) \"Only calculation leaks\"  
[PERSON] et al. [12] proposed the concept of \"only calculation leaks\" (OCL): it is required that the leakage can only occur in the computing portion, so the portion that does not participate in the computing does not leak information. The total leakage amount and the leakage function form are not limited. In this model, [PERSON] et al. [13] proposed a secure stream cipher scheme. [PERSON] et al. [14] constructed one time scheme, which was later widely used in other schemes. (2) Bounded-leakage model  
For a cold start attack, even parts that do not participate in the computation can leak information. To solve this problem, [PERSON] et al. [15] gave the concept of bounded-leakage model (BLM). It is required that the leakage function has a bounded output. [PERSON] et al. [16] extended the concept of bounded leakage and presented the entropy-bounded-leakage model. There is no requirement on the output length about the leakage function, only that the system's secret information derived from the leakage function has a bounded entropy loss. [PERSON] et al. [15] gave a specific public key encryption (PKE) scheme and an identity-based encryption scheme, which are leakage-resilient. [PERSON] et al. [16] used the hash proof system (HPS) to obtain an encryption scheme with chosen plaintext attack (CPA) security and an encryption scheme with chosen ciphertext attack (CCA2) security, which resist side-channel attacks. The leakage rate of the private key for their scheme with CCA2 security can only reach one-sixth. [PERSON] et al. [17] proposed a lattice-based PKE scheme. The paper [18] presented an effective LR PKE. The work [19] used anonymous HPS to construct an anonymous LR PKE. [PERSON] et al. [20] gave an efficient leakage-resilient identity-based encryption scheme. Following the basic requirement of the \"only calculation leaks\" model and bounded-leakage model, [PERSON] et al. [21] introduced the noise-leakage model, which can capture the power consumption and electromagnetic leakage well. [PERSON] et al. [22] proposed the random detection model, which includes noise leakage. Unlike the construction of LR cryptosystems through specific number theory and algebraic hypothesis, [PERSON] et al. [23] constructed LR PKE schemes through any standard PKE under general and minimum assumptions. Only if a one-way function exists, then they can construct LR symmetric key encryption, etc. [PERSON] et al. [24] weakened the limitations on the leakage function and only required that the output of the leakage function has sufficient minimum entropy. What is more, they did not limit the amount of leakage. The safety of their scheme was proven by using the general bilinear group theory. They proposed a scheme that was easily implemented by coding technology, and the scheme was implemented by software based on the MIRACL library. [PERSON] et al. [25] designed hardware devices for the zero-knowledge proof and general multiparty computation. This construction can unconditionally capture the \"onlycalculation leaks\" of the real side-channel attack. They provided different tradeoffs between efficiency and security. 1. Continual leakage model  
When the side-channel attack continues, the leakage may gradually increase and eventually exceed the given limit. BLM cannot solve this problem. Both refs. [26; 27], respectively, presented the concept of the continuous-leakage model (CLM). Their main idea is to refresh the secret key periodically. The restrictions are that the leakage is bounded between two consecutive updates. The leakage of the whole process can be unlimited.