# Registered Keyword Searchable Encryption Based on SM9
## 2 Preliminaries
### Baver Triple
When it receives \(e_{0}\) and \(f_{0}\) from the adversary, the simulator computes \(e=e_{0}+e_{1}\bmod N\) and \(f=f_{0}+f_{1}\bmod N\);
6. The simulator randomly selects \([u\cdot v]_{1}\in\mathbb{Z}_{N}^{*}\) and sends it to the adversary;
7. When it receives \([u\cdot v]_{0}\) from the adversary, the simulator computes \(u\cdot v=[u\cdot v]_{0}+[u\cdot v]_{1}\bmod N\);
8. When it receives \(\theta_{0}P_{2}\) from the adversary, the simulator computes \(\theta_{1}P_{2}=\frac{v_{1}}{u\cdot v}P_{2}\);
9. The simulator computes \(rsd_{w}=P_{2}-H_{1}(w_{b})(\theta_{0}P_{2}+\theta_{1}P_{2})\);

**Guess. **: The adversary outputs a guessed bit \(b^{\prime}\in\{0,1\}\). **Analysis. **: In Step 5 and Step 6 above, since

\[\left\{ \begin{array}{l}u_{1}-a_{1}=e_{1}\bmod N\\ v_{1}-b_{1}=f_{1}\bmod N\\ e\cdot f+e\cdot b_{1}+a_{1}\cdot f+c_{1}=[u\cdot v]_{1}\bmod N\\ (a_{0}+a_{1})(b_{0}+b_{1})=c_{0}+c_{1}\bmod N\end{array} \right.\]

and other parameters are known except \(a_{1}\), \(b_{1}\), \(c_{1}\), and \(v_{1}\), where \(u_{1}=s_{0,1}+H_{1}(w_{b})_{1}\), the above equation implicitly determines the shares \(a_{1}\), \(b_{1}\), \(c_{1}\), and \(v_{1}\) of the parameters \(a\), \(b\), \(c\), and \(v\). Therefore, the game simulated by the simulator is exactly the same as the real game. In the simulated game, since the information sent by the simulator to the adversary is randomly selected and independent of the challenge keyword \(w_{b}\), the probability that the adversary's guess \(b^{\prime}\) is correct is \(1/2\); that is, the advantage is zero. This completes the proof of Theorem 3. ## 5 Implementation and Performance

### Efficiency Analysis

Up to now, no SM9-based registration keyword searchable encryption scheme has been found. For resisting insider keyword guessing attacks, we compared six studies [8; 13; 15; 17; 18; 30] theoretically. 1. **Computation. ** In Table 2, the time of common cryptographic operations is defined by taking the Type-F curve as an example, where \(T_{\text{bp}}\) represents the time of bilinear pairing operation, \(T_{\text{expt}}\) represents the time of exponential operations over groups \(G_{T}\), \(T_{\text{m1}}\) and \(T_{\text{m2}}\) represent the time of scalar multiplication operations of groups \(G_{1}\) and \(G_{2}\), respectively, and \(H_{G_{T}}\) and \(T_{H}\) represent the time of mapping a value to \(G_{T}\) and \(\{0,1\}^{n}\), respectively. The operation results in Table 2 are our simulations. It can be seen from Table 2 that the order of commonly used cryptographic operation time is \(T_{\text{bp}}>H_{G_{T}}>T_{\text{expt}}>T_{\text{m2}}>T_{\text{m1}}>T_{H}\). Note that the operations \(T_{\text{bp}}\) and \(H_{G_{T}}\) are much larger than other operations, and the operations \(T_{H}\) are close to 0. Table 3 compares the operations required by PEKS Ciphertext, Trapdoor, and Testing of each scheme. The main comparison operations include bilinear pairing operations, exponential operations, multiplication operations, and hash operations. It can be seen from Table 3 that RKSE-SM9 is the same as that of [30], and better than others in the ciphertext algorithm. This is because other schemes have bilinear pairing operations in the PEKS Ciphertext. For Trapdoor, our scheme and that of [30] have the same operations, which are slightly slower than that of [8; 15] and faster than others. For Testing, our scheme is the same as that of [15; 18], closer to that of [30] and faster than the schemes of [8; 13; 17]. 2. **Communication. ** In Table 4, we use \(|G_{1}|\), \(|G_{2}|\), and \(|G_{T}|\) to denote the element lengths in groups \(G_{1}\), \(G_{2}\), and \(G_{T}\), respectively. The scheme of [8] requires the most expensive communication overhead when generating a public key, whereas the schemes [8; 15; 17] require the least amount of communication overhead when generating PEKS Ciphertext and are consistent with our scheme in terms of communication overhead, while our system and the one in [30] have comparable communication costs.