## 5 The Proposed Scheme
### The Designed Fast Searchable Decryption Algorithm
To initiate the process, \(\mathcal{C}\) sets up the required cryptographic groups and parameters. Subsequently, \(\mathcal{C}\) prepares the group \(GP\), which includes the elements \(\mathbb{D},H_{2}^{*},H_{3}^{*},g^{a},g^{b}\), and shares these parameters with the adversary \(\mathcal{A}\). This information is provided to \(\mathcal{A}\) to ensure the transparency of the challenge setup. * _Query Phase 1_: In this phase, \(\mathcal{A}\) is allowed to make several polynomially bounded queries, which are outlined as follows:
* \(H_{2}\) _query_: \(\mathcal{A}\) is permitted to query the random oracle \(H_{2}\) at any time. Initially, \(\mathcal{C}\) creates an empty list to store entries for \(H_{2}\), which consist of tuples in the form \((w_{i},h_{i},e_{i},c_{i})\). Upon receiving a query from \(\mathcal{A}\) for a keyword \(w_{i}\in\{0,1\}^{*}\), \(\mathcal{C}\) checks whether this keyword is already present in the list. If the entry exists, the value \(H_{2}(w_{i})\) is returned as \(h_{i}\in\mathbb{G}\). If the keyword is not yet listed, \(\mathcal{C}\) randomly selects a value \(c_{i}\in\{0,1\}\), where \(\Pr[c_{i}=0]=\left(\frac{1}{q_{T}}+1\right)\). After this, \(\mathcal{C}\) stores the entry \((w_{i},h_{i},e_{i},c_{i})\) in the list and returns \(H_{2}(w_{i})=h_{i}\) to \(\mathcal{A}\). * \(H_{3}\) _query_: \(\mathcal{A}\) is also allowed to query the random oracle \(H_{3}\) at any point during the interaction. To manage these queries, \(\mathcal{C}\) initializes an empty list for \(H_{3}\), which stores entries in the form \((t_{i},V_{i})\). When \(\mathcal{A}\) queries \(H_{3}\) with an element \(t_{i}\in\mathbb{G}_{T}\), \(\mathcal{C}\) checks whether \(t_{i}\) is already present in the list. If the entry for \(t_{i}\) exists, \(\mathcal{C}\) returns the stored value \(H_{3}(t_{i})=V_{i}\in\{0,1\}^{\log_{p}}\). If no such entry is found, \(\mathcal{C}\) randomly selects a new value \(V_{i}\in\{0,1\}^{\log_{p}}\) and assigns it to \(H_{3}(t_{i})\). The tuple \((t_{i},V_{i})\) is then added to the list for future reference, and \(V_{i}\) is returned to \(\mathcal{A}\). * _Trapdoor query_: In this phase, \(\mathcal{A}\) submits keywords \(w_{i}\in\{0,1\}^{*}\) to \(\mathcal{C}\), for which it seeks trapdoors. Initially, \(\mathcal{C}\) queries the oracle \(H_{2}\) to retrieve the value \(H_{2}(w_{i})=h_{i}\in\mathbb{G}\) and obtains the associated entry \((w_{i},h_{i},e_{i},c_{i})\). If the value of \(c_{i}\) is 0, \(\mathcal{C}\) aborts. Otherwise, when \(c_{i}=1\), \(\mathcal{C}\) proceeds by setting \(h_{i}=g^{e_{i}}\in\mathbb{G}\), where \(e_{i}\) is the value from the entry. Next, \(\mathcal{C}\) selects a random value \(\tau\in\mathbb{Z}_{p}^{*}\) and queries the \(H_{3}\) oracle with \(H_{3}(e(g^{\beta},(g^{\alpha})^{\tau}))\). Following this, \(\mathcal{C}\) computes the components of the trapdoor as follows: \[ \begin{split} T_{1}^{*}&=H_{3}(e(g^{\beta},(g^{ \alpha})^{\tau}))=H_{3}(e(g,g)^{\beta\alpha\tau}),\\ T_{2}^{*}&=g^{\tau},T_{3,\mu\
u}^{*}=H_{2}(w_{i})^{ \tau\cdot H_{1}(y_{\mu})}=g^{e_{i}\pi\cdot H_{1}(y_{\mu})}.\end{split} \] (22) Finally, \(\mathcal{C}\) returns the trapdoor tuple \(T_{w}^{*}=(T_{1}^{*},T_{2}^{*},T_{3}^{*})\) to \(\mathcal{A}\). * _Challenge_: In this phase, \(\mathcal{A}\) presents a challenge consisting of a pair of keywords \((w_{0}^{*},w_{1}^{*})\), ensuring that neither of these keywords has been queried during the previous phase. Upon receiving the challenge pair, \(\mathcal{C}\) proceeds by computing an index as follows: \(\mathcal{C}\) queries the oracle \(H_{2}\) twice, obtaining the values \(h_{0}\) and \(h_{1}\) from the respective queries, such that \(H_{2}(w_{0})=h_{0}\) and \(H_{2}(w_{1})=h_{1}\). Subsequently, \(\mathcal{C}\) adds the corresponding entries \((w_{i},h_{i},e_{i},c_{i})_{i=(0,1)}\) to the \(H_{2}\) list. If both \(c_{0}\) and \(c_{1}\) are equal to 0 or 1, \(\mathcal{C}\) aborts the process. Since at least one of \(c_{0}\) or \(c_{1}\) must be 0, \(\mathcal{C}\) can then randomly choose a bit \(q\in\{0,1\}\) and set \(c_{q}=0\).