## 4 Security Assumptions
### Indistinguishable-Chosen Cipher-Text Attack (Ind-CCA)  
In this scheme, we define our proposed asymmetric encryption/decryption function (**ASE**), which satisfies the semantic security in the following definitions.  
First, we define an attacker \(\mathcal{A}\) that can ask encryption/decryption queries in our scheme, respectively. However, the attacker \(\mathcal{A}\) can also make an encryption query to the chosen message that we define as \(M^{\prime}\). The attacker \(\mathcal{A}\) can then also make a decryption query to the decryption oracle, whose task is to decrypt the cipher-text sent \(\mathcal{A}\). Next, we define \(Game\), which is the simulation of our proposed scheme that can equip many different oracles, and oracles can answer back to the adversary depending on the attacker's input messages. We also define some oracles, such as the encryption oracle \(AE_{pk_{\mathcal{T}}}(\cdot,\theta)\) with the security parameter \(\theta\). This encryption oracle can generate the ciphertext according to the received input \(M_{b}\), where \(b\in\{0,1\}\). In addition, we also model the decryption oracle that receives the cipher-text \(C\) from the attacker \(\mathcal{A}\) and returns the final decrypted message \(M\) to the attacker \(\mathcal{A}\). In the following, we consider two situations involving \(\mathcal{A}\).  
**Phase 1**: In this phase, the attacker \(\mathcal{A}\) can make the decryption and encryption queries on a chosen message (call it \(M^{\prime}\)). I.e., if \(\mathcal{A}\) makes an encryption query on the input message \(M^{\prime}\), then \(C^{\prime}\longleftarrow AE_{pk_{\mathcal{T}}}(M^{\prime},\theta)\) returns to \(\mathcal{A}\). At this time, \(\mathcal{A}\) can also make the decryption query on cipher-text \(C^{\prime}\), and the simulator will then forward this \(C^{\prime}\) to the decryption oracle and return the final message \(M^{\prime}\) back to the \(\mathcal{A}\). Additionally, \(\mathcal{A}\) can also make other kinds of queries, such as a hash query to the hash oracles.  
**Challenge**: In this phase, if \(\mathcal{A}\) has performed training on the above encryption/decryption query many times, then, in the following challenge phase, the attacker \(\mathcal{A}\) will choose a challenge message pair \((M_{0}^{*},M_{1}^{*})\) for the simulator for game playing. The simulator then will toss the coin on \(b\) after it receives this message pair. If the final output \(b\) is \(1\), then we can have \(C^{*}\longleftarrow AE_{pk_{\mathcal{T}}}(M_{b}^{*},\theta)\). Otherwise, we have \(C^{*}\longleftarrow AE_{pk_{\mathcal{T}}}(M_{1-b}^{*},\theta)\). After the attacker \(\mathcal{A}\) has asked the cipher-text on the chosen target messages \((M_{0}^{*},M_{1}^{*})\), the only restriction is that the \(\mathcal{A}\) cannot ask the decryption oracle on the target message \((M_{0}^{*},M_{1}^{*})\) with the input cipher-text \(C^{*}\). This query can make the simulation fail due to the simulator cannot be able to tell the answer of cipher-text \(C^{*}\). Except in the above query, \(\mathcal{A}\) can make other kinds of queries on different messages.  
**Lemma 3**.: _In this lemma, we model the above actions as the game simulation steps, which we played with the attacker \(\mathcal{A}\)._\(Game_{\mathcal{A},ASE}^{Ind-CCA-b}(\theta)\)  
**Phase 1.**  
\(T\in\{U,V\}\), \(\{M_{0},M_{1}\}\longleftarrow\mathcal{A}^{ASE_{pk_{T}}(\cdot,\theta),ASD_{k_{T} }(\cdot,\theta),H_{1}(\cdot),H_{2}(\cdot)}\)  
**Challenge Phase.**  
\(b\in\{0,1\},C^{*}\longleftarrow ASE_{pk_{T}}(M_{b}^{*},\theta)\),  
\(b^{\prime}\longleftarrow\mathcal{A}^{ASE_{pk_{T}}(\cdot,\theta)}(C^{*},M_{0}^ {*},M_{1}^{*})\)  
Return \(b^{\prime}\).  
The advantage function of the adversary that \(\mathcal{A}_{ASE}^{Ind-CCA}(\cdot,\theta)\) is defined as \(Adv_{\mathcal{A}ASE}^{Ind-CCA}(\theta)=|Pr[Game_{\mathcal{A},ASE}^{Ind-CCA-1}( \theta)=1]-Pr[Game_{\mathcal{A},ASE}^{Ind-CCA-0}(\theta)=1]|<\frac{1}{2}|Pr[Game_ {\mathcal{A},ASE}^{Ind-CCA-1}(\theta)=1]|\leq\epsilon^{\prime}\).