## 5 Analysis of the Scheme
### Security Analysis of Algorithm  
**Definition 3**. : _If the advantage of any PPT adversary \(\mathcal{A}\) in the above game is negligible, then the LWE-CP-ABE encryption scheme based on the LSSS access control structure is selectively secure under the linear independent restriction._  
**Definition 4**. : _If the LWE assumption holds, the proposed LWE-CP-ABE scheme for all access structures is selectively secure._  
To prove Definition 3, the hybrid games start with the adversary sending an access policy to the challenger and the challenger sending back the public parameters to the adversary. Then, \(\mathcal{A}\) requests to the challenger a polynomial number of secret keys. For each key query, the attacker sends a series of attributes \(U\in\mathbb{U}\) that do not satisfy the access control policy \((\mathbf{M},\rho)\). In addition, the row of the access control in the matrix \(\mathbf{M}\) is marked by attribute in \(U\); that is, the index of \(\mathbf{M}\) in \(\rho^{-1}(U)\) must be linearly independent. After that, the challenger replies to the corresponding user attribute secret key \(\text{SK}\leftarrow\text{\bf KeyGen}(\text{MSK},U)\). Finally, \(\mathcal{A}\) outputs its guess for the bit \(b\) encrypted within the challenge ciphertext. The advantage of the adversary \(\mathcal{A}\) in this game is defined as  
\[\text{Adv}_{\mathcal{A}}^{\text{LWE}-\text{CPABE},\text{SEL}-\text{LI}- \text{CPA}}(\lambda)\triangleq\ |\text{Pr}\big{[}b=b^{\prime}\big{]}-1/2| \tag{24}\]  
Thus, how to generate the public parameters, secret keys, and challenge ciphertext in each hybrid game are described below. **Hybo:**_This hybrid game corresponds to the true weak security selective game of the ABE scheme._  
**Hyp\({}_{\bf 1}\):** _This game is similar to **Hyp\({}_{\bf 0}\)**. The changes between **Hyp\({}_{\bf 0}\)** and **Hyp\({}_{\bf 1}\)** are merely syntactic and indistinguishable. The main difference is described as follows:_  
1. In the _Setup Phase_, the generation of an additional matrix \(\{\textbf{B}\}_{j\in\{2,\cdots,\beta_{\max}\}}\leftarrow\mathbb{Z}_{q}^{n\times m}\) is added between Steps 2 and 3;  
2. In the _Challenge Phase_, let the original \(\{\textbf{v}_{j}\}\) to \(\left\{\hat{\textbf{v}}_{j}\right\}_{j\in\{2,\cdots,\beta_{\max}\}}\leftarrow \mathbb{Z}_{q}^{n}\). The vectors \(\{\hat{\textbf{c}}_{i}\}\) are generated below using matrices while preparing the challenge ciphertext. \[\forall i\in[\ell]:\hat{\textbf{c}}_{i}=M_{i,1}\left(\textbf{s} \textbf{y}^{\top},\overbrace{0,\cdots,0}^{m-1}\right)+\] \[\left[\sum\limits_{j\in\{2,\cdots,\beta_{\max}\}}M_{ij}\hat{ \textbf{v}}_{j}\textbf{B}_{j}\right]-\textbf{s}\textbf{H}_{\rho(i)}+\hat{ \textbf{c}}_{i}\]  
**Hyp\({}_{\bf 2}\):** _This game is the same as **Hyp\({}_{\bf 1}\)**, except for the change of the generation of the matrix \(\{\textbf{H}_{u}\}\) in the **Setup Phase**._  
\[ \begin{array}{lcl}1.\{\textbf{H}_{u}^{\prime}\}_{u\in\rho([\ell])}\gets \mathbb{Z}_{q}^{n\times m}\\ 2.\forall u\in\rho([\ell]):\textbf{H}_{u}&=M_{\rho^{-1}(u),1}\left[\textbf{y}^{ \top}\overbrace{0^{\top}\overbrace{\cdots\left|0^{\top}\overbrace{0^{\top} }\right|}^{m-1}}\right]+\\ &&\\ &\sum_{j\in\{2,\cdots,\beta_{\max}\}}M_{\rho^{-1}(u),j}\textbf{B}_{j}+\vec{ \textbf{H}_{u}}\end{array} \]  
The change between **Hyp\({}_{\bf 2}\)** and **Hyp\({}_{\bf 1}\)** is also only in syntax, so the two mixed games are indistinguishable. **Hyp\({}_{\bf 3}\):** _This game is identical to **Hyp\({}_{\bf 2}\)**, except for the change of the generation of the matrix \(\{\textbf{H}_{u}^{\prime}\}\) in the **Setup phase**:_  
\[ \begin{array}{lcl}1.\{\textbf{R}_{u}\}_{u\in\rho([\ell])}\leftarrow\{-1,1 \}^{m\times m}\\ 2.\textbf{H}_{u}^{\prime}=A_{u}\textbf{R}_{u}\end{array} \]  
According to Lemma 1, **Hyp\({}_{\bf 3}\)** and **Hyp\({}_{\bf 2}\)** are selectively indistinguishable. **Hyb4:**_This game is the same as **Hyb3**, except for the change of the matrix in the **Setup Phase**:_  
\[