## 5 Security Analysis of the New Protocol
### Soundness
**Forge:** Eventually, \(A_{1}\) outputs \((ID^{\prime},K^{\prime},psk^{\prime},x^{\prime},PK^{\prime},W^{\prime},m^{ \prime},T^{\prime})\). \(T^{\prime}\) is the forged tag of the data block \(m^{\prime}\) on the identity \(ID^{\prime}\) with the public key \(PK^{\prime}\). **Analysis:** If \(A_{1}\) wins Game 1, on the one hand, \(B\) can get  
\[e(T^{\prime},g)=e(H_{1}(ID^{\prime}+\delta)^{m^{\prime}},P)\cdot e(H_{2}( \omega^{\prime}),PK^{\prime})\]  
according to the verification Equation (1). On the other hand, \(B\) can retrieve \(H_{1}(ID^{\prime}+\delta)=g^{\mathit{lk}_{1}{}^{\prime}}\) from \(Tab_{1}\) and \(H_{2}(\omega^{\prime})=g^{k_{2}}\) from \(Tab_{3}\). Thus, \(B\) gets \(e(T^{\prime},g)=e(g^{\mathit{lk}_{1}{}^{\prime}}m^{\prime},g^{\prime})\cdot e (g^{k_{2}},PK^{\prime})\). Finally, we can derive that  
\[g^{\mathit{ab}}=\left(\frac{T^{\prime}}{(PK^{\prime})^{k_{2}}}\right)^{\frac{ 1}{k_{1}m^{\prime}}}\]  
which means that \(B\) can solve the CDH problem with non-negligible probability \(\varepsilon\). However, according to CDH assumption, the advantage for \(B\) to solve the CDH problem in \(G_{1}\) is negligible. Thus, \(A_{1}\) cannot win Game 1. This completes the proof. Theorem 2: _In the random oracle model, if a PPT adversary \(A_{2}\) wins Game 2 defined in Section 3 with non-negligible probability \(\varepsilon\), then algorithm \(B\) can solve the CDH problem._  
Proof of Theorem 2: Algorithm \(B\) is given \((g,g^{\mathit{a}},g^{\mathit{b}})\in G_{1}\); its goal is to output \(g^{\mathit{ab}}\in G_{1}\). Algorithm \(B\) simulates the challenger and interacts with as \(A_{2}\) follows. **Setup:**\(B\) produces the system parameters _params_, secret key \(\delta\in Z_{q}^{*}\), and sets \(P=g^{\mathit{s}}\), in which \(\mathit{s}\) is master key. \(B\) sends _params_, \(\delta\), \(\mathit{s}\), and \(P\) to \(A_{2}\). **H\({}_{1}\)-Query**: At any time, \(A_{2}\) can query the random oracle \(H_{1}\). To respond to these queries, algorithm \(B\) maintains a list of tuples \((ID,l_{1},L)\) as \(Tab_{1}\). When \(A_{2}\) queries the oracle \(H_{1}\) at the identity \(ID^{\prime}\), Algorithm \(B\) responds as follows:  
(1) If \(ID^{\prime}\in Tab_{1}\), then algorithm \(B\) retrieves the tuple \((ID^{\prime},l_{1}{}^{\prime},L^{\prime})\) and responds with \(L^{\prime}\) to \(A_{2}\). (2) Otherwise, \(B\) picks a random \(l_{1}{}^{\prime}\in Z_{q}^{*}\) and computes \(L^{\prime}=g^{l_{1}{}^{\prime}}\). Then, it adds the tuple \((ID^{\prime},l_{1}{}^{\prime},L^{\prime})\) to \(Tab_{1}\) and responds with \(L^{\prime}\) to \(A_{2}\). **SecretValue-Query:** Because \(A_{2}\) knows the master key, there is no need for \(A_{2}\) to query the partial key. At any time, \(A_{2}\) can query secret value for any identity \(ID^{\prime}\). If \(ID^{\prime}\
otin Tab_{1}\), \(B\) makes the \(H_{1}\)-Query. Otherwise, \(B\) maintains a list of tuples \((ID,y,Y)\) as \(Tab_{2}\). When \(A_{2}\) queries the oracle SecretValue-Query at the identity \(ID^{\prime}\), Algorithm \(B\) responds as follows:  
(1) If \(ID^{\prime}\in Tab_{2}\), then algorithm \(B\) retrieves the tuple \((ID^{\prime},y^{\prime},Y^{\prime})\) and responds with \(y^{\prime}\) to \(A_{2}\). (2) Otherwise, \(B\) randomly selects \(l_{2}\in Z_{q}^{*}\) and makes \(y^{\prime}=l_{2}\). Then, it adds the tuple \((ID^{\prime},y^{\prime})\) to \(Tab_{2}\) and responds with \(y^{\prime}\) to \(A_{2}\). **PublicKey-Query:** At any time, \(A_{2}\) can query public key for any identity \(ID^{\prime}\), if \(ID^{\prime}\
otin Tab_{1}\) or \(ID^{\prime}\
otin Tab_{2}\). \(B\) first makes the \(H_{1}\)-Query or PartialKey-Query for the identity \(ID^{\prime}\). Then, \(B\) computes\(Y^{\prime}=g^{ab^{\prime}}=g^{a\mu_{2}}\), in which \(y^{\prime}\) is the secret value from SecretValue-Query, and updates \(Tab_{2}\). \(B\) responds with \(Y^{\prime}\) to A\({}_{2}\). **H\({}_{2}\)-Query:** At any time, A\({}_{2}\) can query the random oracle H\({}_{2}\) for \(\omega^{\prime}\).