# Registered Keyword Searchable Encryption Based on SM9
## 2 Preliminaries
### Baver Triple
Since the PEKS is publicly computable, we omit the adversary's query of the ciphertext of the keyword. )_
* _Trapdoor query_ \(\mathsf{Trapdoor}(rsd_{w})\)_: The adversary sends a keyword_ \(w\) _to the challenger, and the challenger sends the search trapdoor_ \(T_{rsd_{w}}\leftarrow\mathsf{Trapdoor}(\mathcal{G},sk_{R},rsd_{w})\) _to the adversary._
* _When the Query_ \(1\) _is over, the adversary selects two never-queried keywords_ \(w_{0}\)_,_ \(w_{1}\)_, and sends them to the challenger. The challenger randomly selects_ \(b\in\{0,1\}\) _and runs the keyword registration algorithm to generate_ \(rsd_{w}\leftarrow\mathsf{RSD}(\mathcal{G},sk_{RS},w_{b})\)_. Finally, it sends the challenge ciphertext_ \(C_{rsd_{w}}\leftarrow\mathsf{PEKS}(\mathcal{G},pk_{R},rsd_{w_{b}})\) _to the adversary._
* _The adversary can continue the query the same as in Query_ \(1\) _except for the two challenge keywords_ \(w_{0}\) _and_ \(w_{1}\)_._
* _The adversary outputs its guess_ \(b^{\prime}\in\{0,1\}\) _and wins the game if_ \(b=b^{\prime}\)_; otherwise, the adversary fails._

_We refer to such an adversary_ \(\mathcal{A}\) _in the above game as an IND-CT-CKA adversary and define its advantage as_ \(\mathsf{Adv}_{\mathsf{CS},\mathcal{A}}^{\mathsf{IND\_CT-CKA}}(\lambda):= \Pr[b=b^{\prime}]-\frac{1}{2}\)_. If for any polynomial-time adversary_ \(\mathcal{A}\)_, its advantage_ \(\mathsf{Adv}_{\mathsf{CS},\mathcal{A}}^{\mathsf{IND\_CT-CKA}}(\lambda)\) _is negligible, we say that the scheme satisfies ciphertext indistinguishability._

**Definition 5** (IND-TD-CKA Security Model). : _The IND-CT-CKA security model is defined as follows:_

* _Same as in Definition_ 4_._
* _When Query_ \(1\) _is over, the adversary chooses two never-queried keywords,_ \(w_{0}\) _and_ \(w_{1}\)_, and sends them to the challenger. The challenger randomly selects_ \(b\in\{0,1\}\) _and runs the keyword registration algorithm to generate_ \(rsd_{w}\leftarrow\mathsf{RSD}(\mathcal{G},sk_{RS},w_{b})\)_. Finally, it sends the challenge search trapdoor_ \(T_{rsd_{w}}\leftarrow\mathsf{Trapdoor}(\mathcal{G},sk_{R},rsd_{w_{b}})\) _to the adversary._
* _Same as in Definition_ 4_._
* _The adversary outputs its guess_ \(b^{\prime}\in\{0,1\}\) _and wins the game if_ \(b=b^{\prime}\)_; otherwise, the adversary fails._

_The adversary_ \(\mathcal{A}\)_'s advantage in the above game is defined as_ \(\mathsf{Adv}_{\mathsf{CS},\mathcal{A}}^{\mathsf{IND\_TD-CKA}}(\lambda):= \Pr[b=b^{\prime}]-\frac{1}{2}\)_. If for any polynomial-time adversary_ \(\mathcal{A}\)_, its advantage_ \(\mathsf{Adv}_{\mathsf{CS},\mathcal{A}}^{\mathsf{IND\_TD-CKA}}(\lambda)\) _is negligible, we say that the scheme satisfies trapdoor indistinguishability._

**Honest but Curious Registration Server (RS). **: It is assured that neither the registration server nor outside attackers will learn anything about the registered keywords from the new keyword registration methodology. The following definition is for Registered Keywords Indistinguishability against Selected Keyword Attack (IND-RK-CKA). The opponent may work with one of the two keyword registration servers in the next game. We make the assumption that the adversary works with server \(0\) without losing generality. **Definition 6** (IND-RK-CKA Security Model). : _The IND-RK-CKA game is defined as follows:_

* _The challenger generates public parameter_ \(\mathcal{G}\)_, key pairs_ \((pk_{RS_{i}},sk_{RS_{i}})\) _and_ \((pk_{R},sk_{R})\)_, and sends_ \((\mathcal{G},pk_{RS_{0}},sk_{RS_{0}},pk_{RS_{1}},pk_{R},\) _and_ \(sk_{R})\) _to the adversary._
* _The adversary selects two challenge keywords,_ \(w_{0}\) _and_ \(w_{1}\)_, and sends them to the challenger.