## 5 Analysis of the Scheme
### Security Analysis of Algorithm
**Hybs**: _This game is analogous to **Hyb\({}_{\mathbf{\jmath}}\)**, except for the generation of vector \(\{\mathbf{k}_{u}\}_{u\in U\cap\varphi([\ell])}\) while answering the key query of the adversary \(\mathcal{A}\). The changes are described as follows:_  
\[ \begin{array}{l}1.\Big{\{}\tilde{\mathbf{k}}_{u}\Big{\}}_{u\in U\cap\varphi([\ell] )}\leftarrow\mathcal{X}_{2}\\ \forall u\in U\cap\rho([\ell]):\\ 2.\sum\limits_{j\in\{2,\cdots,\delta_{\max}\}}M_{\rho^{-1}(u)}\mathbf{f}_{i}= \tilde{\mathbf{k}}_{u}\mathbf{A}_{u}^{\top}+\tilde{\mathbf{k}}_{u}\mathbf{A}_{u}^{\top}\end{array} \]  
**Hyb\({}_{\mathbf{\jmath}}\)**: _This game is similar to **Hyb\({}_{\mathbf{\jmath}}\)**, except for the matrix generation \(\{\mathbf{A}_{u}\}_{u\in U\cap\varphi([\ell])}\leftarrow\mathbb{Z}_{q}^{n\times m}\) during the Setup phase. The indistinguishableness between **Hyb\({}_{\mathbf{\jmath}}\)** and **Hyb\({}_{\mathbf{\jmath}}\)** originates from the enhanced trapdoors function \(\textbf{EnLT}=(\textbf{EnTrapGen},\textbf{EnSamplePre})\). **Hyb\({}_{\mathbf{\imath}}\)**: _This game is the same as **Hyb\({}_{\mathbf{\jmath}}\)** except for the generation of the vector \(\{\hat{\mathbf{e}}_{i}\}\) in challenging ciphertext during the Challenge phase, i.e.,_  
\[ \begin{array}{l}1.\big{\{}\mathbf{e}^{\prime}_{i}\big{\}}_{i\in[\ell]}\leftarrow \mathcal{X}_{\text{big}}^{m}\\ 2.\forall i\in[\ell]:\hat{\mathbf{e}}_{i}=-\mathbf{e}_{i}\mathbf{R}_{\rho(i)}+\mathbf{e}^{ \prime}_{i}\end{array} \]  
According to Lemma 1, **Hyb\({}_{\mathbf{\imath}}\)0** and **Hyb\({}_{\mathbf{\imath}}\)9** are selectively indistinguishable. **Hyb\({}_{\mathbf{\imath}1}\)**: _This game is the same as **Hyb\({}_{\mathbf{\imath}}\)0**, except for the change in challenging ciphertext during the stage of Challenge:_  
In the **Challenge Phase**, we have:  
\[ \begin{array}{l}1.\tau\leftarrow\mathbb{Z}_{q}\\ 2.\{\hat{\mathbf{\upsilon}}^{\prime}_{j}\}_{i\in\{2,\cdots,\delta_{\max}\}} \leftarrow\mathbb{Z}_{q}^{n}\\ 3.\{\mathbf{e}^{\prime}_{i}\}_{i\in[\ell]}\leftarrow\mathcal{X}_{\text{big}}^{m}\\ 4.\{\mathbf{c}_{i}\}_{i\in[\ell]}\leftarrow\mathbb{Z}_{q}^{m}\\ \forall i\in[\ell]:\\ 5.\ \ \hat{\mathbf{c}}_{i}=[\sum\limits_{j\in\{2,\cdots,\delta_{\max}\}}M_{ij}\mathbf{ \vartheta}^{\prime}_{j}\mathbf{B}_{j}]-\mathbf{c}_{i}\mathbf{R}_{\rho(i)}+\mathbf{e}^{\prime}_ {i}\\ 6.\text{CT}=\Big{(}\{\mathbf{c}_{i}\}_{i\in[\ell]},\{\hat{\mathbf{c}}_{i}\}_{i\in[\ell]},\text{MSB}(\tau)\Big{)}\end{array} \]  
According to the hypothesis of the LWE difficulty problem, **Hyb\({}_{\mathbf{\imath}}\)0** and **Hyb\({}_{\mathbf{\imath}}\)9** are selectively indistinguishable. For any adversary \(\mathcal{A}\) and any \(x\in\{0,\cdots,11\}\), let \(p_{\mathcal{A},x}:\mathbb{N}\rightarrow[0,1]\) be a function. For all \(\lambda\in\mathbb{N}\), we define the probability of the adversary winning the mixed game as \(p_{\mathcal{A},x}(\lambda)\). According to the definition of Hyb\({}_{0}\), for all \(\lambda\in\mathbb{N}\): \(|p_{\mathcal{A},0}(\lambda)-1/2|=\text{Adv}_{\mathcal{A}}^{\text{LWE}-\text{ CPBE},\text{EL}-\text{CFA}}\) (\(\lambda\)). In addition, for all \(\lambda\in\mathbb{N}\), there is \(p_{\mathcal{A},11}=1/2\), there is no challenger's information about selecting the challenge bit in the challenge ciphertext in Hyb\({}_{11}\). Therefore, for all \(\lambda\in\mathbb{N}\), there is: \(\text{Adv}_{\mathcal{A}}^{\text{LWE}-\text{CFA}/\text{BE}}(\lambda)\leq\sum \limits_{x\in[11]}|p_{\mathcal{A},x-1}(\lambda)-p_{\mathcal{A},x}(\lambda)|\). In Hyb\({}_{0}\) and Hyb\({}_{1}\), the vector \(\{\hat{\mathbf{\upsilon}}_{j}\}_{j\in\{2,\cdots,\delta_{\max}\}}\) is uniformly and independently distributed on \(\mathbb{Z}_{q}^{n}\), and the matrix \(\{\mathbf{B}_{j}\}_{j\in\{2,\cdots,\delta_{\max}\}}\) is uniformly and independently distributed on \(\mathbb{Z}_{q}^{m\times n}\), so \(\{\hat{\mathbf{\upsilon}}_{j}\mathbf{B}_{j}\}_{j\in\{2,\cdots,\delta_{\max}\}}\) is also uniformly and independently distributed on \(\mathbb{Z}_{q}^{m}\).