## 4 Blockchain-Based LWE-CP-ABE Data Sharing Scheme
### Data Sharing Scheme in Key Management Network and Blockchain Network
That is, sample \(a\in\mathbb{Z}_{q}\) uniformly at random, computes \(g^{a}\) and outputs the key pair \((pk,sk)=(g^{a},a)\). The re-encryption key generation algorithm takes as input the DO's secret key \(a\), the DU's public key, \(pk_{DU}=g^{b}\), several fragments N, and a threshold \(t\), DO computes N fragments of the re-encryption key \(rk_{DO\to DU}\) between DO and DU, each of them named \(kFrag\). In this step, an ephemeral symmetric key generated by DO is used to encrypt the MSK, and the symmetric key is encrypted using DO's asymmetric encryption key. The encrypted MSK and the encrypted symmetric key (the KEM portion, called a capsule) are stored together in TPS. Next, as shown in Figure 3, to gain the MSK, DU requests the capsule-associated key fragments \(kFrag\) to give to the KMN for re-encryption operation. Those \(n\) designated nodes in KMN perform a partial operation to produce a corresponding ciphertext fragment named \(cFrag\). Meanwhile, a correctness proof \(\pi\) for the resulting fragment is constructed using a non-interactive zero-knowledge proof of discrete logarithm equality to verify the correctness. These fragments are returned to DU, which collects \(cFrag\)s until it obtains an \(m\)_-of-\(n\)_ threshold. Finally, DU can decrypt the capsule to obtain the symmetric key \(K\) to decrypt the encrypted MSK. Thus, to keep this paper compact, all above mentioned PRE protocol that we introduced uses the UMBERAL scheme [43] and is served as a decentralized key management system to distribute and manage the MSK that is applied to key generation and decryption for DU of LWE-CP-ABE. Meanwhile, the activities of DO/DU, including authorization, request, and policy making, are written into blockchain by a smart contract. (2) Data encryption. The DO formulates the access control policy \((\mathbf{M},\rho)\). \((\mathbf{M},\rho)\) is the LSSS access control policy, in which \(\mathbf{M}=\left(M_{i,j}\right)_{\ell\times s_{\max}}\in\{-1,0,1\}^{\ell\times s_{ \max}}\subset\mathbb{Z}_{q}^{\ell\times s_{\max}}\), \(\rho\) represents the mapping (monomorphism) function \(\rho:[\ell]\rightarrow\mathbb{U}\), and it maps the access control matrix \(\mathbf{M}_{i}\) to the attribute set \(\mathbb{U}\). After that, the DO runs the **Enc** algorithm, inputs the PK, the plaintext \(m\), and the access control policy \((\mathbf{M},\rho)\), and gets the CT. The specific algorithm is shown in Algorithm 2. ```
Input: the PK, the plaintext \(m\), and the access control policy \((\mathbf{M},\rho)\); Output: the CT.
1. Generate Access Policy \((\mathbf{M},\rho)\);
2. Select a random vector \(\mathbf{s}\leftarrow\mathbb{Z}_{q}^{m}\) ; /* the secret sharing key */
3. Sample a vector \(\left\{\mathbf{p}_{j}\right\}_{j\in\{2,\cdots,s_{\max}\}}\leftarrow\mathbb{Z}_{q} ^{m}\) ;
4. for each \(i\in[\ell]\) Select random noise \(\left\{\mathbf{e}_{i}\right\}_{i\in[\ell]}\leftarrow\mathcal{X}_{\text{live}}^{m}\) and \(\left\{\hat{\mathbf{e}}_{i}\right\}_{i\in[\ell]}\leftarrow\mathcal{X}_{\text{lig} }^{m}\) ;  Compute \(\mathbf{c}_{i},\hat{\mathbf{e}}_{i}\in\mathbb{Z}_{q}^{m}\) We have; \[\mathbf{c}_{i} =\mathbf{s}\mathbf{A}_{\rho(i)}+\mathbf{e}_{i}\] \[\hat{\mathbf{e}}_{i} =M_{i,1}\left(\mathbf{sy}^{\top},\overbrace{0,\cdots,0}^{m-1}\right) +\left[\sum\limits_{j\in\{2,\cdots,s_{\max}\}}M_{ij}\mathbf{p}_{j}\right]\] \[\quad-\mathbf{s}\mathbf{H}_{\rho(i)}+\hat{\mathbf{e}}_{i}\]
5. \(\text{CT}=\left((\mathbf{M},\rho),\left\{\mathbf{c}_{i}\right\}_{i\in[\ell]},\left\{ \hat{\mathbf{e}}_{i}\right\}_{i\in[\ell]},\text{C}=\text{MSB}\left(\mathbf{sy}^{\top} \right)\oplus m\right)\). ```  
**Algorithm 2**Data Encryption Algorithm  
The [PERSON] uploads the CT to the TPS, which generates the contract transaction \(T_{X}\)_CT_Adness_ = {_TPS_, _BN_, \(A\), \(D\), _Timestamp_, _CT_Adness_, _SigTPS_, $_$  
fragments to decrypt the re-encrypted capsule using his private key. Finally, [PERSON] obtains the symmetric key to decrypt encrypted MSK.