# Registered Keyword Searchable Encryption Based on SM9
## 2 Preliminaries
### Baver Triple  
**Definition 3** (Beaver Triple). : _The Bauer triple, also known as a multiplication triple, is mainly used for multiplication calculations in secure multi-party computing protocols. Its specific algorithm is shown in Algorithm 1. In the table, for any integer \(x\), \(x_{1}\), and \(x_{2}\), denote the two random shares of \(x\), such that \(x=x_{1}+x_{2}\). The operation maybe operates over some ring \(\mathbb{Z}_{N}\). \(c_{1}\) and \(c_{2}\) are the random shares of the multiplication \(a\cdot b\). Let \(P_{0}\) and \(P_{1}\) denote two parties._```
0: Shares \(u_{i}\), \(v_{i}\), \(a_{i}\), \(b_{i}\), and \(c_{i}\). 0: Shares \([u\cdot v]_{i}\). 1. \(P_{i}\) computes \(e_{i}=u_{i}-a_{i}\) and \(f_{i}=v_{i}-b_{i}\). 2. \(P_{0}\) and \(P_{1}\) jointly construct \(e\) and \(f\). 3. \(P_{i}\) computes \([u\cdot v]_{i}=i\cdot e\cdot f+e\cdot b_{i}+a_{i}\cdot f+c_{i}\). ```

**Algorithm 1** Beaver Triple

## 3 The Proposed RKSE-SM9 Scheme

### System Model

In this section, we introduce the system model and formal definition of RKSE-SM9. Figure 1 displays the RKSE-SM9 scheme's system model, which includes the following four entities:

Registration Server (RS): Input a keyword \(w\); it generates a registered keyword \(rsd_{w}\). Sender: Input a registered keyword; it generates a keyword ciphertext \(C_{rsd_{w}}\) and uploads it into a cloud server. Receiver: Input a registered keyword; it locally generates a keyword trapdoor \(T_{rsd_{w}}\) for searching. Cloud Server (CS): Stores ciphertexts and trapdoors, runs test algorithms to search keyword ciphertexts, and returns the results to the user. The RKSE-SM9 scheme consists of the following seven algorithms: \(\mathsf{SysSetup}\), \(\mathsf{KeyGen}_{RS}\), \(\mathsf{KeyGen}_{R}\), \(\mathsf{RSD}\), \(\mathsf{PEKS}\), \(\mathsf{Trapdoor}\), and \(\mathsf{Test}\). * \(\mathsf{SysSetup}(\lambda)\to\mathcal{G}\): Input \(\lambda\), which is a security parameter in the system, and output a public parameter \(\mathcal{G}\). * \(\mathsf{KeyGen}_{RS}(\mathcal{G})\to(pk_{RS},sk_{RS})\): Input \(\mathcal{G}\), then output the registration sever's key pair \((pk_{RS},sk_{RS})\). * \(\mathsf{KeyGen}_{R}(\mathcal{G})\to(pk_{R},sk_{R})\): Input \(\mathcal{G}\), then output the receiver's key pair \((pk_{R},sk_{R})\). * \(\mathsf{RSD}(\mathcal{G},sk_{RS},w)\to rsd_{w}\): Input \(\mathcal{G}\), \(sk_{RS}\), and \(w\), outputs the RS-derived keyword \(rsd_{w}\). * \(\mathsf{PEKS}(\mathcal{G},pk_{R},rsd_{w})\to C_{rsd_{w}}\): Input \(\mathcal{G}\), \(pk_{R}\), and \(rsd_{w}\), the sender outputs the PEKS ciphertext \(C_{rsd_{w}}\) of \(w\). * \(\mathsf{Trapdoor}(\mathcal{G},sk_{R},rsd_{w^{\prime}})\to T_{rsd_{w^{\prime}}}\): Input \(\mathcal{G}\), \(sk_{R}\), and \(rsd_{w^{\prime}}\), the receiver outputs the search Trapdoor \(T_{rsd_{w^{\prime}}}\) of \(w^{\prime}\). * \(\mathsf{Test}(\mathcal{G},C_{rsd_{w}},T_{rsd_{w^{\prime}}})\to 1/0\): Input \(\mathcal{G}\), \(C_{rsd_{w}}\), and \(T_{rsd_{w^{\prime}}}\), the CS outputs \(1\) if \(w=w^{\prime}\), otherwise outputs \(0\). ### Construction of RKSE-SM9

As shown in Table 1, the elliptic curve and curve parameters used in this scheme are consistent with those used in the SM9 standard. The concrete construction of RKSE-SM9 is as follows:

Figure 1: System Model of RKSE-SM9. * \(\mathsf{SysSetup}(\lambda)\to\mathcal{G}\): Input the security parameter \(\lambda\), it returns a public parameter \(\mathcal{G}\)=(\(N\), \(G_{1}\), \(G_{2}\), \(G_{T}\), \(\hat{e}\), \(P_{1}\), \(P_{2}\), \(H_{1}\), \(H_{2}\), \(H_{3}\)); among them, \(G_{1}\) and \(G_{2}\) are two cyclic additive groups of order prime \(N\), \(G_{T}\) is a multiplicative cyclic group of order prime \(N\), and \(P_{1}\) and \(P_{2}\) are the generators of the groups \(G_{1}\) and \(G_{2}\), respectively. There exists a homomorphic map \(\phi\) from \(G_{2}\) to \(G_{1}\), such that \(\phi\).