# Decentralized Inner-Product Encryption with Constant-Size Ciphertext
## 4 Security Proof
Compute \[\begin{array}{l}E_{0}\ \ =M_{\beta}\cdot(\prod_{i=1}^{n-1}Z_{i})^{s}\cdot\ T\\ \ \ =M_{\beta}\cdot Z_{  
and hence \(C^{*}=(E_{0},E_{1},E_{2})\) is a valid ciphertext. Thus, we have:  
\[\mathbf{Adv}_{\mathcal{A}}^{\text{sIND-CPA}}=\left|\Pr[\beta^{\prime}=\beta]- \frac{1}{2}\right|,\]  
and  
\[\Pr[\mathcal{C}(g,g^{\gamma},g^{\gamma^{2}},\ldots,g^{\gamma^{\ell}},g^{\gamma^ {\ell+2}},\ldots,g^{\gamma^{2\ell}},g^{s},T=e(g,g)^{\gamma^{\ell+1}s})=1]=\Pr[ \beta^{\prime}=\beta]\]  
\[=\mathbf{Adv}_{\mathcal{A}}^{\text{sIND-CPA}}+\frac{1}{2}.\]  
If \(T\) is a random element from \(\mathbb{G}_{T}\), then the message \(M_{\beta}\) is completely hidden from the adversary's view, since \(E_{0}\), \(E_{1}\) and \(E_{2}\) are all independently random elements. Therefore, the advantage of the adversary is:  
\[\mathbf{Adv}_{\mathcal{A}}^{\text{sIND-CPA}}=\left|Pr[\beta^{\prime}=\beta]- \frac{1}{2}\right|=0,\]  
and  
\[\Pr[\mathcal{C}(g,g^{\gamma},g^{\gamma^{2}},\ldots,g^{\gamma^{\ell}},g^{ \gamma^{\ell+2}},\ldots,g^{\gamma^{2\ell}},g^{s},T=e(g,g)^{\  
The length of ciphertexts and private keys are shown in Table 3. Due to decentralization, it is normal that the private key length of DIPE is larger than that of IPE. In addition, though, we can see that [25] needs about \(\mathcal{O}(nk)\) elements in \(\mathbb{G}\) for a private key. Indeed, the value of \(k\) can be small in their work. However, in our work, the vector size could be large in reality. Therefore, our private key length is larger than others, which may need more storage. Nevertheless, if the value of \(k\) is greater or equal than our vector size. Then, we only need less storage than [25] in storing the private key. Note that the work of [11] achieves constant private key size. As a trade-off, their ciphertext size is \(\mathcal{O}(\ell)|\mathbb{G}_{T}|\), which might be longer then others in the respect of the curve used in implementation. In the comparison of ciphertext length, both our work and [5] have the least ciphertext length and only needs two elements in \(\mathbb{G}\) plus an element in \(\mathbb{G}_{T}\). It means that our ciphertext length is independent with the vector size and the number of the authorities. It can reduce the burden of connection between sender and receiver for transmitting ciphertext. However, the ciphertext length of [25] dependent on \(n\) and \(k\). To the best of our knowledge, our work is the first DIPE scheme achieving a constant-size ciphertext. In Table 4, only our work, as well as [25], achieves a decentralized framework. In order to avoid collusion between users, a \(GID\) and a predicate (or an attribute) vector \(\vec{X}\) are mapped to a value by a random oracle. Therefore, the security of ours and [25]'s are both proven in the random oracle model. As far as we know, there is no standard model for DIPE currently. In addition, although ours and [25]'s are both CPA secure, the latter achieves adaptive security, which is stronger than our selective model. Though all the works in Table 4 achieve CPA security, we should note that [11]'s security is proven in a relatively less used model, called a co-selective model, where an adversary outputs several vectors for querying the Key-Extract oracle in Phase 1 before seeing the system parameter. Although selective security and co-selective security are both weaker than full security, both notions are incomparable in general by definition.