# Registered Keyword Searchable Encryption Based on SM9
## 2 Preliminaries
### Baver Triple
That is, \(RS_{0}\) obtains \(H_{1}(w)_{0}\) and \(RS_{1}\) obtains \(H_{1}(w)\); 3. The user generates two random numbers \(a,b\in\mathbb{Z}_{N}^{*}\), computes \(c=a\cdot b\bmod N\), and sends the secret sharing \(a=a_{0}+a_{1}\), \(b=b_{0}+b_{1}\), and \(c=c_{0}+c_{1}\) to \(RS_{0}\) and \(RS_{1}\), respectively. That is, \(RS_{0}\) obtains shares \(a_{0},b_{0},c_{0}\), and \(RS_{1}\) obtains shares \(a_{1},b_{1},c_{1}\); 4. The user generates a random number \(v\in\mathbb{Z}_{N}^{*}\), and sends the secret sharing \(v=v_{0}+v_{1}\) to \(RS_{0}\) and \(RS_{1}\), respectively. That is, \(RS_{0}\) obtains share \(v_{0}\), and \(RS_{1}\) obtains share \(v_{1}\); 5. \(RS_{i}\)\((i=0,1)\) computes \(u_{i}=s_{0,i}+H(w)_{i}\), \(e_{i}=u_{i}-a_{i}\) and \(f_{i}=v_{i}-b_{i}\), respectively. Then, \(RS_{i}\) broadcasts \(e_{i}\) and \(f_{i}\), leading to reconstruction of \(e\) and \(f\);\(RS_{i}\) (\(i=0,1\)), respectively, computes \([u\cdot v]_{i}=i\cdot e\cdot f+e\cdot b_{i}+a_{i}\cdot f+c_{i}\). That is, \(RS_{0}\) computes \([u\cdot v]_{0}=e\cdot b_{0}+a_{0}\cdot f+c_{0}\) and \(RS_{1}\) computes \([u\cdot v]_{1}=e\cdot f+e\cdot b_{1}+a_{1}\cdot f+c_{1}\);
7. \(RS_{0}\) and \(RS_{1}\) broadcast \([u\cdot v]_{i}\), leading to the reconstruction of \(u\cdot v\);
8. \(RS_{0}\) and \(RS_{1}\) compute \(\theta_{i}=\frac{v_{i}}{u\cdot v}\), respectively, then sends \(\theta_{0}P_{2}\) and \(\theta_{1}P_{2}\) to the user;
9. The user computes \(rsd_{w}=P_{2}-H_{1}(w)\cdot(\theta_{0}P_{2}+\theta_{1}P_{2})=\frac{s_{0}}{s_ {0}+H_{1}(w)}P_{2}\). ### Security Model

In this section, we define the security models for the RKSE-SM9 scheme in terms of the Cloud Server and the Registration Server, respectively. **Adversarial Cloud Server (CS). ** An internal adversary is thought to be the adversarial cloud server. Here, we describe the semantic security of this system under the assumption of internal adversaries, including Ciphertext Indistinguishability against Adaptive Chosen Keyword Attack (IND-CT-CKA) and Trapdoor Indistinguishability against Adaptive Chosen Keyword Attack (IND-TD-CKA). **Definition 4** (IND-CT-CKA Security Model). : _The IND-CT-CKA security model is defined as follows:_

**Setup. **: _The challenger generates public parameter_ \(\mathcal{G}\)_, key pairs_ \((pk_{RS},sk_{RS})\) _and_ \((pk_{R},sk_{R})\)_, and sends_ \((\mathcal{G},pk_{RS},pk_{R})\) _to the adversary._

**Query 1**. : _The adversary can adaptively query the challenger with the following queries:_

* _Hash query_ \(H_{i}(\cdot)\)_: For the value_ \(x\) _queried by the adversary, the corresponding hash value_ \(H_{i}(x)\) _is returned._
* _Keyword registration query_ \(\mathsf{RSD}(\cdot)\)_: The adversary sends the challenger a keyword_ \(w\)_, and the challenger returns_ \(rsd_{w}\leftarrow\mathsf{RSD}(\mathcal{G},sk_{RS},w)\) _to the adversary. (We assume that the adversary must ask for the registration result of the keyword before \begin{table}
\begin{tabular}{c c} \hline \hline
**Notations** & **Description** \\ \hline \(G_{1}\) & a cyclic additive group of order prime number \(N\) \\ \(P_{1}\) & generator for the group \(G_{1}\) \\ \(G_{2}\) & a cyclic additive group of order prime number \(N\) \\ \(P_{2}\) & generator for the group \(G_{2}\) \\ \(G_{T}\) & a multiplicative group of order \(N\) \\ \(N\) & the order of group \(G_{1}\), \(G_{2}\), \(G_{T}\), is a prime number greater than \(2^{191}\) \\ \(\varepsilon\) & bilinear pairing \(\varepsilon:G_{1}\times G_{2}\to G_{T}\) \\ \(H_{1}\) & a hash function \(H_{1}:\{0,1\}^{*}\to Z_{N}^{*}\) \\ \(H_{2}\) & a hash function \(H_{2}:G_{2}\to Z_{N}^{*}\) \\ \(H_{3}\) & a secure hash function \(H_{3}:G_{T}\to\{0,1\}^{n}\) \\ \((pk_{RS},sk_{RS})\) & the public/private key pair of the registration server \\ \((pk_{R},sk_{R})\) & the public/private key pair of the receiver \\ \(rsd_{w}\) & RS-derived keyword of \(w\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Symbol table in the RKSE-SM9. Figure 2: The RSD algorithm. asking for the ciphertext of the keyword.