# Decentralized Inner-Product Encryption with Constant-Size Ciphertext
## 3 The Proposed Scheme  
In this section, we present our decentralized inner product encryption scheme with constant-size ciphertexts. The notations used in the proposed scheme are defined in Table 1.  
\(\mathbf{Setup}(1^{\lambda})\)  
The algorithm performs the following steps:  
1. Randomly choose bilinear groups \(\mathbb{G},\mathbb{G}_{T}\) of prime order \(p\) with a generator \(g\stackrel{{\$}}{{\leftarrow}}\mathbb{G}\);
2. Choose an one-way hash function, \(H:\{0,1\}^{*}\times\mathbb{Z}_{p}^{\ell}\rightarrow\mathbb{G}\);
3. Output the public parameter \(pp=\{g,H\}\).  
\(\mathbf{AuthSetup}(pp,i)\)  
Each authority \(A_{i}\) in the system performs the following steps to generate its public key and its master secret key:  
1. Choose \(\pi_{i}\stackrel{{\$}}{{\leftarrow}}\mathbb{Z}_{p}\);
2. Choose \(\alpha_{0,i}\stackrel{{\$}}{{\leftarrow}}\mathbb{Z}_{p}\);
3. Choose \(\alpha_{1,i},\alpha_{2,i},\ldots,\alpha_{\ell,i}\stackrel{{ \$}}{{\leftarrow}}\mathbb{Z}_{p}\);
4. Output a public key of authority \(i\), \(PK_{i}=\{g^{\alpha_{0,i}},g^{\alpha_{1,i}},\ldots,g^{\alpha_{\ell,i}},Z_{i}=e( g,g)^{\overline{x}_{i}}\}\);
5. Output a master secret key of authority \(A_{i}\), \(MSK_{i}=\{g^{\overline{x}_{i}},\alpha_{0,i},\alpha_{1,i},\ldots,\alpha_{\ell,i}\}\). \(\mathbf{KeyGen}_{\mathbf{A_{i}}}(pp,MSK_{i},GID,\vec{X}=(x_{1},\cdots,x_{\ell}))\)  
Each authority \(A_{i}\) in the system performs the following steps to generate a part of private key for receivers in the system\"  
1. Return failure symbol \(\bot\) if \(x_{1}=0\);
2. Output the private key \(sk_{i}=\{D_{0},D_{1,i},\{K_{j,i}\}_{j=2,\ldots,\ell}\}\), where  
\(D_{0}=H(GID,\vec{X})\)  
\(D_{1,i}=g^{\overline{x}_{i}}\cdot H(GID,\vec{X})^{\alpha_{0,i}}\)  
\(\{K_{j,i}=H(GID,\vec{X})^{-\alpha_{1,i}\frac{x_{j}}{x_{1}}}\cdot H(GID,\vec{ X})^{\alpha_{ij}}\}_{j=2,\ldots,\ell}\). Unlike the \(\mathbf{KeyGen}\) algorithm in [25], we use the entire predicate vector \(\vec{X}\) in \(\mathbf{KeyGen}_{\mathbf{A_{i}}}\) performed by a single authority \(A_{i}\). \(\mathbf{Encrypt}(pp,\{PK_{i}\}_{i=1,\ldots,n},M,\vec{Y}=(y_{1},\ldots,y_{\ell}))\)  
A sender computes the ciphertext for a message \(M\in\mathbb{G}_{T}\) and an attribute vector \(\vec{Y}=(y_{1},\ldots,y_{\ell})\) by the following steps: \begin{table}
\begin{tabular}{c l} \hline \hline
**Notation** & **Description** \\ \hline \(\mathbb{G}\) & a bilinear group with prime order p \\ \hline \(\mathbb{G}_{T}\) & a bilinear group by pairing of the element of \(\mathbb{G}\) \\ \hline \(e\) & a bilinear mapping; \(e:\mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G}_{T}\) \\ \hline \(g\) & a generator of \(\mathbb{G}\) \\ \hline \(n\) & total number of authorities \\ \hline \(\ell\) & the length of predicate/attribute vector \\ \hline \(A_{i}\) & \(i\)th authority \\ \hline \(pp\) & public parameter \\ \hline \(PK_{i}\) & public key of authority \(i\) \\ \hline \(MSK_{i}\) & master secret key of authority \(i\) \\ \hline \(\vec{X}\) & a predicate vector \\ \hline \(\vec{Y}\) & an attribute vector \\ \hline \(GID\) & an identity of a receiver \\ \hline \(M\) & a message \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations. 1. Choose \(s\stackrel{{\xi}}{{\leftarrow}}\mathbb{Z}_{p}\);
2. Output the ciphertexts as \(C=\{E_{0},E_{1},E_{2}\}\), where \(E_{0}=M\cdot(\prod_{i=1}^{n}Z_{i})^{s}\) \(E_{1}=((\prod_{i=1}^{n}g^{\alpha_{i}})\cdot(\prod_{i=1}^{n}g^{\alpha_{1,i}})^{ y_{1}}\cdot\ldots\cdot(\prod_{i=1}^{n}g^{\alpha_{i}})^{y_{t}})^{s}\) \(E_{2}=g^{s}\). \(\mathbf{Decrypt}(\{sk_{i}\}_{i=1,\ldots,n},C)\)  
To decrypt, a receiver uses the private key \(\{sk_{i}\}_{i=1,\ldots,n}\) to recover the message \(M\) from a ciphertext \(C\) as follows:  
1. If \(\langle\vec{X},\vec{Y}\rangle=0\), perform the following computation; otherwise, return \(\bot\);
2. Compute \[\left(\prod_{i=1}^{n}Z_{i}\right)^{s}=\left(\prod_{i=1}^{n}e(g,g)^{\overline{ x}_{i}}\right)^{s}=\frac{e((\prod_{i=1}^{n}D_{1,i})\cdot(\prod_{i=1}^{n}K_{2,i})^{y_{2} }\ldots(\prod_{i=1}^{n}K_{\ell,i})^{y_{\ell}},E_{2})}{e(E_{1},D_{0})}.\]
3.