# Secure Proxy Re-Encryption Protocol for FANETs Resistant to Chosen-Ciphertext Attacks
## 5 Security Analysis
### Proof of Security
Otherwise, \(\Delta\) follows the Phase 1 response protocol. \(\mathfrak{O}_{rk}\): When receiving input \((pk_{i},pk_{k})\), if \(pk_{i}=pk^{\#}\), and \(pk_{j}\) is in table \(T_{sk}\), \(\Delta\) terminates. Otherwise, \(\Delta\) responds in line with the Phase 1 protocol. \(\mathfrak{O}_{rk}\): On input \((pk_{i},pk_{j},\ C)\), if \((pk_{i},C)=(pk^{*},C^{*})\) and \(pk_{j}\) is present in the table \(T_{sk}\), \(\Delta\) terminates. Otherwise, \(\Delta\) responds as in Phase 1, except when \(pk_{i}=pk^{\#}\) and \((C_{1},\ C_{2})=(C_{1}^{*},\ C_{2}^{\#})\). \(\Delta\) should record the result \((pk_{j},\ g^{\prime},\ R_{1},\ R_{2})\) in \(T_{dcr}\). \(\quad\)\(\mathfrak{O}_{dec}\): On input \((pk_{i},rk_{i\to j}^{1},R_{1},R_{2})\), if \((pk_{i},rk_{i\to j}^{1},R_{1},R_{2})=(pk^{\#},\ (rk^{1})^{\#},\ R_{1}^{\#},\ R_{2}^{\#})\) or is in \(T_{dcr}\), or \((R_{1},R_{2})=\text{PrxyRE}(O_{rk}(pk^{\#},pk_{j}),C^{\#})\), \(\Delta\) terminates. Otherwise, \(\Delta\) responds as in Phase 1. _Guess_. A outputs a guess b'. If \(b=b^{\prime}\), \(\Delta\) outputs 0 (GDDH instance). Otherwise, it outputs 1 (not a GDDH instance), because the encryption will be random for RE if and only if the challenge is not a GDDH tuple, \(\Delta\) solves the GDDH challenge with the same advantage as A. In more detail, in the case of b = 0, \(RE=(R_{1},\ R_{2})=((S_{0})^{ax_{1}},\ (S_{0})^{ax_{1}\cdot x_{2}\cdot\gamma}.m _{x_{2}\cdot\gamma})=\big{(}(S_{0})^{\beta},(S_{0})^{\beta\delta r\cdot m}\big{)}= ((S_{0})^{\beta},(S_{0})^{\rho\cdot m})\). If b = 1, \(\Delta\) returns a random value in reply to the GDDH challenge. If \(\rho=\beta\delta\tau\), it is the encryption of RE. Otherwise, it is not an encryption. It is shown that \(\Delta\) can solve the GDDH problem \((\rho=\beta\delta\tau)\) with non-negligible probability. \[ \begin{array}{rl}Adv_{\Delta}&=\Pr\big{[}Exp_{\Delta}^{GDDH}=1\big{]}=\Pr[b =b^{\prime}]\\ &=\Pr\big{[}b^{\prime}=b\,|\,b=1\big{]}\cdot\Pr[b=1]+\Pr[b^{\prime}=b\,|\,b=0 \cdot]\cdot\Pr[b=0]\\ &=\Pr\big{[}b^{\prime}=1\,\big{|}\,b=1\big{]}\cdot\frac{1}{2}+\Pr\big{[}b^{ \prime}=0\,|\,b=0\cdot]\cdot\frac{1}{2}\\ &=\Pr\big{[}b^{\prime}=1\,\big{|}\,b=1\big{]}\cdot\frac{1}{2}+(1-\Pr\big{[}b^{ \prime}=1\,\big{|}\,b=0\big{]})\cdot\frac{1}{2}\\ &=\frac{1}{2}+\frac{1}{2}(\Pr[b^{\prime}=1\,|\,b=1]-\Pr[b^{\prime}=1\,|\,b=0 \,])\\ &=\frac{1}{2}+\frac{1}{2}(\Pr[Exp_{\text{PA}}^{LPF-1}=1\big{]}-\Pr\big{[}Exp_{ \text{A}}^{LPF-0}=1\big{]})\\ &=\frac{1}{2}+\frac{1}{2}Adv_{\text{A}}^{LPF}=\frac{1}{2}+\frac{1}{2}\epsilon \end{array} \]  
Theorem 4.1: _(Unidirectional Proxy Re-Encryption Collusion-Resistant(CR) Security) If is a secure pseudorandom function and random numbers are generated from a secure pseudorandom generator, then scheme UPF is collusion-resistant._  
The cryptographic elements for the whole protocol are PRF (pseudorandom function, e.g., 128 bit-AES) and PRG (pseudorandom generator, e.g., middle-square method, Naor-Reingold pseudorandom function, etc.). Proof: We assume C as an adversary against the Uni-PRE-CR with advantage \(\epsilon\) and \(\beta\) as a distinguisher between random and pseudorandom. Here, we also use contraposition, so all we have to do is to construct \(\beta\) using \(C\) as a subroutine. C can collude and know the secret key (k) values of other pre-registered members. Since the encrypted and transmitted \(f_{k_{C5}}(S_{1},\ S_{2}),\ f_{k_{E}}(S_{3},\ S_{4})\) can be decrypted to \((S_{1},\ S_{2}),\ (\ (S_{3},\ S_{4})\) using the secret key, the re-encrypted message \((R_{1},\ R_{2})\) can be decrypted to the original message m. Then, \(\beta\) will also be able to distinguish whether the challenged message is the result of an encrypted value or a random value. \(\square\)