# Decentralized Inner-Product Encryption with Constant-Size Ciphertext
## 4 Security Proof
### Experimental Result  
In this section, we show the experimental results of our construction and the construction of [25] via Python and C languages, and analyze the execution time of the five algorithms. Table 5 shows the system configuration and the chosen pairing group of Python. We implement our construction by Charm-Crypto library in Python. In our implementation, the pairing group is a symmetric pairing curve with a 512-bit-based field. The experiment is executed on Intel(R) Core(TM) i7-10875H CPU at 3.60 GHz processor, 4 GB memory size and under the Ubuntu-16.04 operating system. In addition, we also implement our scheme and [25] in C with the pbc library, where a Type a1 pairing group is used. Table 6 shows the details for the system configuration of our C implementation. We analyze the time cost of each algorithm in our DIPE scheme below. In our experiment, the length of \(GID\) (global identity) is set to 10 bits for convenience. However, note that the length of a \(GID\) can be arbitrarily long since it is a input of the hash function. In [25], since each authority generates a partial key for an element of the predicate vector, therefore, the length of th vector size should be the same as the total number of authorities, ranging from 1 to 25 in our implementation. In addition, the value of \(k\) in [25] is set to one to minimize the cost of their work. The value of each point on the figure is obtained by executing the algorithm 1000 times and obtaining the value of the average execution time. For the implementation using Python, Figure 1b shows that the time spent by [25] on the **AuthSetup** algorithm is more time-consuming than ours. In Figure 1d,e, we can note that the **Encrypt** and **Decrypt** algorithms are both growing linearly in two schemes when \begin{table}
\begin{tabular}{c c} \hline CPU & Intel(R) Core(TM) i5-8257U CPU @ 1.40 GHz \\ \hline Memory & 2 GB \\ \hline OS & Docker:Debian10 \\ \hline Package & pbc-0.5.14 \\ \hline Pairing group & Type a1 \\ \hline \end{tabular}
\end{table} 
Table 6: System configuration and elliptic curve for C. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Decentralization** & **Confidentiality** & \begin{tabular}{c} **Security** \\ **Model** \\ \end{tabular} & \
\begin{tabular}{c} **Group** \\ **Order** \\ \end{tabular} &
\begin{tabular}{c} **Complexity** \\ **Assumption** \\ \end{tabular} \\ \hline
[3] & No & CPA & STD & Composite & SD \\ \hline
[8] & No & CPA & STD & Prime & \(\mathcal{P}\)-DBDH \\ \hline
[5] & No & CPA & STD & Prime & \(\ell\)-DBDHE \\ \hline
[11] & No & CPA\({}^{\star}\) & STD & Prime & M-DDH\({}_{\mathrm{G}_{T}}\) \\ \hline
[25] & Yes & CPA & ROM & Prime & \(k\)-Lin \\ \hline Ours & Yes & CPA & ROM & Prime & \(\ell\)-DBDHE \\ \hline \end{tabular}
\end{table} 
Table 4: Property comparison. \begin{table}
\begin{tabular}{c c} \hline \hline CPU & Intel(R) Core(TM) i7-10875H CPU @ 2.30 GHz \\ \hline Memory & 4 GB \\ \hline OS & Ubuntu-16.04 (64-bit) \\ \hline Package & Python Charm-Crypto (v0.43) library \\ \hline Pairing group & SS512 \\ \hline \end{tabular}
\end{table} 
Table 5: System configuration and elliptic curve for Python. the number of authorities increases. However, ours has better performance than theirs. Then, Figure 1c exhibits that **KeyGen** is the most time-consuming algorithm due to the decentralized network. Nevertheless, we have relatively poorer performance than [25]. Since our decentralization is different from [25], in our scheme, each authority generates a partial key for a whole predicate vector instead of only an element. Therefore, the execution time of **KeyGen** is longer. Finally, in Figure 1a, the **Setup** algorithm only generates some generator of \(\mathbb{G}\), some elements of \(\mathbb{G}\) and the description of a hash function in both schemes. Thus, execution time is independent of the total number of authorities and vector size. In addition, our scheme has one more advantage, that is, the length of the predicate vector does not need to bind with the total number of authorities with same value.