# Decentralized Inner-Product Encryption with Constant-Size Ciphertext
## 3 The Proposed Scheme
### Correctness  
The correctness of the decryption algorithm is described as follows. For convenience, let \(\overline{\alpha}=\sum_{i=1}^{n}\overline{\alpha_{i}},\alpha_{j}=\sum_{i=1}^{ n}\alpha_{j,i}\), for \(j=0,\ldots,\ell\). It is enough to show that  
\[e(g,g)^{\overline{\alpha}_{0}s}=\left(\prod_{i=1}^{n}e(g,g)^{\overline{x}_{i} }\right)^{s}=\frac{e((\prod_{i=1}^{n}D_{1,i})\cdot(\prod_{i=1}^{n}K_{2,i})^{y_ {2}}\ldots(\prod_{i=1}^{n}K_{\ell,i})^{y_{\ell}},E_{2})}{e(E_{1},D_{0})}.\]  
We first take a look at the numerator:  
\[\prod_{i=1}^{n}D_{1,i} =\prod_{i=1}^{n}g^{\overline{x}_{i}}\cdot H(GID,\vec{X})^{\alpha_ {0i}}=g^{\sum_{i=1}^{n}\overline{x}_{i}}\cdot H(GID,\vec{X})^{\sum_{i=1}^{n} \alpha_{0i}}=g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\] \[\prod_{i=1}^{n}K_{j,i} =\prod_{i=1}^{n}H(GID,\vec{X})^{-\alpha_{1}\frac{x_{i}}{x_{1}}} \cdot H(GID,\vec{X})^{\alpha_{j,i}}=H(GID,\vec{X})^{\frac{-x_{j}}{x_{1}}} \sum_{i=1}^{n}\alpha_{1,i}+\sum_{i=1}^{n}\alpha_{j,i}\] \[=H(GID,\vec{X})^{\alpha_{1}(\frac{-x_{j}}{x_{1}})+x_{j}},\]  
where \(j=2,\ldots,\ell\). Using the fact that  
\[\langle\vec{X},\vec{Y}\rangle=0\Leftrightarrow\sum_{i=1}^{\ell}x_{i}y_{i}=0 \Leftrightarrow y_{1}=\frac{\sum_{i=2}^{\ell}(-x_{i}y_{i})}{x_{1}},\]  
we have:  
\[(\prod_{i=1}^{n}D_{1,i})\cdot(\prod_{i=1}^{n}K_{2,i})^{y_{2}} \ldots(\prod_{i=1}^{n}K_{\ell,i})^{y_{\ell}}\] \[= g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\cdot(H(GID, \vec{X})^{\alpha_{1}(\frac{-x_{2}}{x_{1}})+x_{2}})^{y_{2}}\cdot\ldots\cdot(H( GID,\vec{X})^{\alpha_{1}(\frac{-x_{j}}{x_{1}})+x_{\ell}})^{y_{\ell}}\] \[= g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\cdot(H(GID, \vec{X})^{\alpha_{1}\frac{\sum_{i=1}^{\ell}(-x_{i}y_{i})}{x_{1}}+\sum_{i=2}^{ \ell}x_{i}y_{i}}\] \[= g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\cdot H(GID, \vec{X})^{\alpha_{1}y_{1}+\sum_{i=1}^{\ell}x_{i}y_{i}}\] \[= g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\cdot H(GID, \vec{X})^{\sum_{i=1}^{\ell}x_{i}y_{i}}.\]  
Thus, the numerator is:  
\[e(g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\cdot H(GID, \vec{X})^{\sum_{i=1}^{\ell}x_{i}y_{i}},E_{2})\] \[= e(g^{\overline{x}}\cdot H(GID,\vec{X})^{\alpha_{0}}\cdot H(GID, \vec{X})^{\sum_{i=1}^{\ell}x_{i}y_{i}},g^{s})\] \[= e(g,g)^{\overline{x}_{8}}\cdot e(H(GID,\vec{X}),g)^{(\alpha_{0} +\sum_{i=1}^{\ell}a_{i}y_{i})s}.\]In addition, the denominator is:  
\[\begin{array}{ll}&e(E_{1},D_{0})\\ =&e((\prod_{i=1}^{n}g^{\alpha_{0i}})\cdot(\prod_{i=1}^{n}g^{\alpha_{1,i}})^{y_{1} }\cdot\ldots\cdot(\prod_{i=1}^{n}g^{\alpha_{\ell,i}})^{y_{\ell}})^{s},H(GID, \vec{X}))\\ =&e(g^{\sum_{n=1}^{n}\alpha_{0i}}\cdot g^{y_{1}\sum_{n=1}^{n}\alpha_{1,i}}\cdot \ldots\cdot g^{y_{\ell}\sum_{n=1}^{n}\alpha_{\ell,i}},H(GID,\vec{X}))^{s}\\ =&e(g^{\alpha_{0}}\cdot g^{x_{1}y_{1}}\cdot\ldots\cdot g^{x_{\ell}y_{\ell}},H( GID,\vec{X}))^{s}\\ =&e(g^{\alpha_{0}+\sum_{\ell=1}^{n}\alpha_{1,i}y_{i}},H(GID,\vec{X}))^{s}\\ =&e(H(GID,\vec{X}),g)^{(\alpha_{0}+\sum_{\ell=1}^{n}\alpha_{1,i}y_{i})s}.\\ \end{array}\]  
Finally, we have:  
\[\frac{\text{numerator}}{\text{denominator}}=\frac{e(g,g)^{\overline{\alpha}s }\cdot e(H(GID,\vec{X}),g)^{(\alpha_{0}+\sum_{i=1}^{\ell}\alpha_{i}y_{i})s}}{e (H(GID,\vec{X}),g)^{(\alpha_{0}+\sum_{i=1}^{\ell}\alpha_{i}y_{i})s}}=e(g,g)^{ \overline{\alpha}s}.\]