## 5 The Proposed VR-PEKS Scheme
### Security  
Our VR-PEKS scheme is implemented using a fully homomorphic encryption BFV scheme [34], which is implemented based on the RLWE problem. RLWE is a ring-based version of the LWE problem [38], which is defined as follows. Definition 1 (RLWE). For security parameter \(\lambda\), let \(f(x)\) be a cyclotomic polynomial \(\Phi_{m}(x)\) with \(deg(f)=\varphi(m)\) depending on \(\lambda\) and set \(R=\mathbb{Z}[x]/f(x)\). Let \(q=q(\lambda)\geq 2\) be an integer. For a random element \(\mathbf{s}\in R_{q}\) and distribution \(\chi=\chi(\lambda)\) over \(R\), denote with \(A^{q}_{\mathbf{s},\chi}\) the distribution obtained by choosing a uniformly random element \(\mathbf{a}\gets R_{q}\) and a noise term \(\mathbf{e}\gets R_{q}\) and outputting \((\mathbf{a},\left[\mathbf{a}\cdot\mathbf{s}+\mathbf{e}\right]_{q})\). The \(Decision-RLWE_{d,\chi}\) problem is to distinguish between the distribution \(A^{q}_{\mathbf{s},\chi}\) and the uniform distribution \(U(R^{2}_{q})\). The \(Search-RLWE_{d,\chi}\) problem is to find \(\mathbf{s}\) by given \((\mathbf{a},A^{q}_{\mathbf{s},\chi})\). Theorem 4.1: _Assuming that the RLWE problem is hard and the oblivious pseudorandom function used is a random oracle function, VR-PEKS can safely resist KGA._  
**Lemma 1**. : _Assuming that the RLWE problem is hard and the oblivious pseudorandom function used is a random oracle function, then VR-PEKS satisfies KC-IND-CKA security._  
Proof. : The proof against KC-IND-CKA will be composed of the following three games. \(\mathcal{A}\) is the adversary against KC-IND-CKA security. In \(Game_{i}\), let \(\mathcal{A}\) go to attack KC-IND-CKA security. The event \(\mathcal{A}\) guessed correctly is defined as \(S_{i}\) (namely, \(b^{\prime}=b\)). \(Game_{1}\). This is the game that we originally designed. The advantage of adversary \(\mathcal{A}\) winning the game is  
\[Adv(\mathcal{A})=\left|\Pr\left[b^{\prime}=b\right]-\frac{1}{2}\right|=\left| \Pr\left[S_{1}\right]-\frac{1}{2}\right|\]  
\(Game_{2}\). This is the same as \(Game_{1}\), except that the challenge is terminated when the following events occur: \(F_{k}(w)=F_{k}(w_{b}),w\
eq w_{b}\). It is not difficult to find that in order to terminate the challenge, there must be an enemy \(B_{\infty}\) that can break the oblivious pseudorandom function \(F\) with a certain advantage \(\varepsilon_{1}\). Therefore, according to the difference lemma, the probability of the enemy \(\mathcal{A}\) guessing correctly in \(Game_{1}\) and \(Game_{2}\) has the following relation:  
\[\left|\Pr\left[S_{1}\right]-\Pr\left[S_{2}\right]\right|\leq\varepsilon_{1}\]  
\(Game_{3}\). The difference between \(Game_{3}\) and \(Game_{2}\) lies in the means of challenging the ciphertext. Challenger \(\mathcal{C}\) replaces the keyword ciphertext produced in the form \(\left(\left[\mathbf{p}_{0}\cdot\mathbf{u}+\mathbf{e}_{1}+\triangle\cdot F_{k} (\mathbf{w}_{\mathbf{b}})\right]_{q^{\prime}}\left[\mathbf{p}_{1}\cdot \mathbf{u}+\mathbf{e}_{2}\right]_{q}\right)\) with a uniform random distribution \(U(R_{q}^{2})\). Then, \(Game_{2}\) and \(Game_{3}\) should be consistent, unless there is an adversary \(B_{\in}\) who can distinguish \(U(R_{q}^{2})\) and \(\left(\left[\mathbf{p}_{0}\cdot\mathbf{u}+\mathbf{e}_{1}+\triangle\cdot F_{k} (\mathbf{w}_{\mathbf{b}})\right]_{q^{\prime}}\left[\mathbf{p}_{1}\cdot \mathbf{u}+\mathbf{e}_{2}\right]_{q}\right)\) with a non-negligible advantage (that is, to solve the RLWE problem). Thus, there is \(\left|\Pr\left[S_{2}\right]-\Pr\left[S_{3}\right]\right|\leq\varepsilon_{2}\). Because \(U(R_{q}^{2})\) is uniformly and randomly distributed, the advantage of the adversary's correct guess in \(Game_{3}\) is \(\Pr\left[S_{3}\right]=1/2\).