# Decentralized Inner-Product Encryption with Constant-Size Ciphertext
## 4 Security Proof  
In this section, we will prove the sIND-CPA security for the proposed under the \(\ell\)-DBDHE assumption in the random oracle model. Theorem 4.1: _The proposed DIPE scheme is sIND-CPA secure if the q-DBDHE assumption holds._  
Proof: Assume there is a polynomial-time adversary that can win the sIND-CPA game with a non-negligible advantage. Then, we construct a PPT challenger \(\mathcal{C}\) able to solve the \(\ell\)-DBDHE problem as follows:  
First of all, \(\mathcal{C}\) is given an instance of the \(q\)-DBDHE problem, that is,  
\[\Big{(}g,g^{\gamma},g^{\gamma^{2}},\ldots,g^{\gamma^{\prime}},g^{\gamma^{ \prime+2}},\ldots,g^{\gamma^{\prime 2\prime}},g^{s},T\Big{)},\]  
where \(T\) is \(e(g,g)^{\gamma^{\ell+1}s}\) or a random element of \(\mathbb{G}_{T}\). Then, \(\mathcal{C}\) interacts with \(\mathcal{A}\) in the game as follows. **Initialization. **  
\(\mathcal{A}\) first sends the target vector \(\vec{Y}^{*}=(y_{1}^{*},y_{2}^{*},\ldots,y_{\ell}^{*})\) to \(\mathcal{C}\). **Setup. **  
Without loss of generality, we may assume that \(\mathcal{A}\) can obtain the first \(n-1\) master secret keys \(MSK_{i}\) of authorities, where \(i=1,\ldots,n-1\):  
1. Set \((g^{\alpha_{1,n}},g^{\alpha_{2,n}},\ldots,g^{\alpha_{\ell,n}})=(g^{\gamma},g^{ \gamma^{2}},\ldots,g^{\gamma^{\ell}})\). Define \(\vec{\alpha}_{n}=\langle\alpha_{1,n},\alpha_{2,n},\ldots,\alpha_{\ell,n}\rangle\);
2. Choose \(\delta\xleftarrow{\xi}\mathbb{Z}_{p}\);
3. Compute \(Z_{n}=e(g,g)^{\overline{\alpha}_{n}}=e(g^{\gamma},g^{\gamma^{\ell}})\) and \(g^{\alpha_{0,n}}=\Big{(}(g^{\gamma})^{y_{1}^{*}}(g^{\gamma^{2}})^{y_{2}^{*}} \ldots(g^{\gamma^{\ell}})^{y_{\ell}^{*}}\Big{)}^{-1}\cdot g^{\delta}\);
4. For \(i=1,\ldots,n-1\), \(\mathcal{C}\), compute \(PK_{i}\) and \(MSK_{i}\) following the \(\mathbf{AutSetup}(pp,i)\) shown in Section 3;
5. Send to \(\mathcal{A}\) the public keys \(\{PK_{i}\}_{i=1,\ldots,n}=\{g^{\alpha_{0,i}},g^{\alpha_{1,i}},\ldots,g^{\alpha_ {\ell,i}},Z_{i}=e(g,g)^{\overline{\alpha}_{i}}\}_{i=1,\ldots,n}\), and the master secret key s \(\{MSK_{i}\}_{i=1,\ldots,n-1}=\{g^{\overline{\alpha}_{i}},\alpha_{0,i},\alpha_{1, i},\ldots,\alpha_{\ell,i}\}_{i=1,\ldots,n-1}\). Here, we implicitly set \[\overline{\alpha}_{n}=\gamma^{\ell+1},\qquad\alpha_{0,n}=-\langle\overline{ \alpha}_{n},\vec{Y}^{*}\rangle+\delta,\qquad\{\alpha_{j,n}=\gamma^{j}\}_{j=1 \ldots,\ell}.\]  
**Phase1. **  
\(\mathcal{C}\) maintains a hash list, \(H\)-list, to store the mapping result of \(H(GID,\vec{X})\). Then, \(\mathcal{A}\) is allowed to query the following oracles:  
* Hash oracle:This oracle takes \(\vec{X}\in\mathbb{Z}_{p}^{\ell}\) and \(GID\in\{0,1\}^{*}\)(global identity) as input and outputs an element of \(\mathbb{G}\). If there exists a record \((GID,\vec{X},v_{k},V_{k})\) in the \(H\)-list, return \(V_{k}\). Otherwise, the oracle performs the following steps:  
1. If \(\langle\vec{X},\vec{Y}^{*}\rangle=0\), then randomly choose \(V_{k}\stackrel{{\$}}{{\leftarrow}}\mathbb{G}\) and return \(V_{k}\) to \(\mathcal{A}\);
2. Choose \(v_{k}\stackrel{{\$}}{{\leftarrow}}\mathbb{Z}_{p}^{*}\);
3. Implicitly set \[t=\frac{x_{1}\gamma^{\ell}+x_{2}\gamma^{\ell-1}+\ldots+x_{\ell}\gamma}{ \langle\vec{X},\vec{Y}^{*}\rangle}+v_{k}\] by computing \[V_{k}=g^{t}=(g^{\intercalintercal})^{\frac{x_{j}}{\langle\vec{X},\vec{Y}^{*} \rangle}}\cdot\ldots\cdot(g^{\intercal^{\prime-1}})^{\frac{x_{2}}{\langle\vec {X},\vec{Y}^{*}\rangle}}\cdot(g^{\intercal^{\prime}})^{\frac{x_{1}}{\langle \vec{X},\vec{Y}^{*}\rangle}}\cdot g^{v_{k}}.\] This can be efficiently computed with the instance of \(q\)-DBDHE problem;
4. Return \(H(GID,\vec{X})=V_{k}\) to \(\mathcal{A}\) and store \((GID,\vec{X},v_{k},V_{k})\) into the \(H\)-list. 5.