# Practical Inner Product Encryption with Constant Private Key +
## 2 Preliminaries
### Security Model  
Here, we first introduce IND-CPA security for IPE. The IND-CPA game of IPE for the attribute vector space \(\mathfrak{A}\) and predicate vector space \(\mathfrak{P}\) is defined as an interactive game between a challenger \(\mathcal{C}\) and an adversary \(\mathcal{A}\). * **Setup**. The challenger \(\mathcal{C}\) runs \(\mathbf{Setup}(1^{\lambda},1^{\ell})\) and sends the system parameter params to the adversary \(\mathcal{A}\). * **Query Phase 1**. The challenger polynomially answers many private key queries for \(\mathbf{y}\in\mathfrak{P}\) for the adversary \(\mathcal{A}\) by returning \(\mathbb{K}_{\mathbf{y}}\leftarrow\mathbf{KeyGen}(\mathtt{params},\mathtt{msk}, \mathbf{y})\). * **Challenge**. The adversary \(\mathcal{A}\) submits an attribute vector \(\mathbf{x}^{*}\in\mathfrak{A}\) such that \(\langle\mathbf{x}^{*},\mathbf{y}\rangle\
eq 0\) for all \(\mathbf{y}\) that have been queried in **Query Phase 1** and two messages \(M_{0},M_{1}\) with the same length to challenger \(\mathcal{C}\). Then, \(\mathcal{C}\) randomly chooses \(\beta\in\{0,1\}\) and returns a challenge ciphertext \(\mathtt{c}_{\mathbf{x}^{*}}\leftarrow\mathbf{Encrypt}(\mathtt{params},\mathbf{ x}^{*},M_{\beta})\). * **Query Phase 2**. This phase is the same as **Query Phase 1**, except that the adversary is not allowed to make a query with \(\mathbf{y}\in\mathfrak{P}\) such that \(\langle\mathbf{x}^{*},\mathbf{y}\rangle\
eq 0\). * **Guess**. The adversary \(\mathcal{A}\) outputs a bit \(\beta^{\prime}\) and wins the game if \(\beta^{\prime}=\beta\). The advantage of an adversary for winning the IND-CPA game is defined as  
\[Adv^{\mathtt{IND-CPA}}(\mathcal{A})=\left|\Pr[\beta^{\prime}=\beta]-\frac{1}{ 2}\right|.\]  
**Definition 4** (IND-CPA Security for IPE). : _We say that an IPE is IND-CPA secure if there is no probabilistic polynomial-time adversary \(\mathcal{A}\) who wins the IND-CPA game with a nonnegligible advantage._  
As we mentioned in Section 1, in some literature [1, 23], the security notions for an IPE are defined with the notions \"payload hiding\" and \"attribute hiding\". Informally, payload-hiding (or attribute-hiding) is defined to argue that a ciphertext leaks no information about the encrypted message (or attribute vector). The IND-CPA security shown in this section is equivalent to payload-hiding. We emphasize that attribute-hiding is unnecessary for an IPE scheme; in [15, 16, 17], schemes have been proposed satisfying only payload hiding. We next present the selective security and theoselective security [16, 35] for IPE. The selective IND-CPA (sIND-CPA) game is defined the same as the IND-CPA game, except that the adversary \(\mathcal{A}\) is forced to commit before the **Setup** phase to an attribute vector \(\mathbf{x}^{*}\), and \(\mathcal{A}\) is not allowed to make private key queries with \(\mathbf{y}\) such that \(\langle\mathbf{x}^{*},\mathbf{y}\rangle\
eq 0\) in both **Query Phase 1** and **Query Phase 2**. **Definition 5** (sIND-CPA Security for IPE). : _An IPE scheme is said to be sIND-CPA secure if no probabilistic polynomial-time adversary wins the sIND-CPA game with a nonnegligible advantage._  
Theoselective IND-CPA (csIND-CPA) game is defined as equal to the IND-CPA game, except that the adversary \(\mathcal{A}\) is forced to commit before the **Setup** phase \(q\) to predicate vectors \(\mathbf{y}^{(1)},\ldots,\mathbf{y}^{(q)}\) for the private key queries, where \(q\) is a polynomial in the security parameter \(\lambda\) and \(\mathcal{A}\) is required to invoke the **Challenge** phase with an attribute vector \(\mathbf{x}^{*}\) such that \(\langle\mathbf{x}^{*},\mathbf{y}^{(j)}\rangle\
eq 0\) for \(j=1,\ldots,q\). **Definition 6** (csIND-CPA Security for IPE). : _An IPE scheme is said to be csIND-CPA secure if no probabilistic polynomial-time adversary wins the csIND-CPA game with a nonnegligible advantage._  
Coselective security can be understood as a complementary notion to selective security.