Challenge simulation Sample Clauses

Challenge simulation and run a standard Ind-CPA game under the the aggregated public encryption key. Denote that a = a1 + +an,r = r1 + +rn. Note that Si∗ = 1, , n i∗ . It follows that the aggregated public encryption key is (R, A) where R = Ri∗ Rk = gri∗ ( gn+1—k) grk g—1 = k∈Si∗ = Σ n k∈Si∗ , k∈Si∗ n+1—k A = Ai∗ k∈Si∗ Ak = e(g, g) gri∗ k∈Si∗ grk g k=1 rk = gr e(g, g) k∈Si∗ e(g, g) ai∗ αn+1 ak e(g, g)ak = e(g, g)αn+1+a.

Challenge simulation and run a standard Ind-CPA game under the the aggregated public encryption key. Denote that a = a1 + + an, r = r1 + · · · { · · · } \ { } + rn. Note that Si∗ = 1, , n i∗ . It follows that the aggregated public encryption key is (R, A) where R = Ri∗ Q k∈Si∗ Rk = gri∗ (Q k=1 k∈Si∗ gn+1−k) Q k∈Si∗ grk g−1 n+1−k Q k = gri∗ Q k∈Si∗ grk = gPn rk = gr, A = Ai∗ A = e(g, g)ai∗ k∈Si∗ k=1 e(g, g)αn+1 Q e(g, g)ak k∈Si∗ = e(g, g)αn+1 Qn e(g, g)ak = e(g, g)αn+1+a. For the aggregated public key (R, A), the decryption keys corresponding to each group member are not revealed. Although neither B nor A know the stars × satisfying e(×, g)e(H(si), R) = A, B knows r, a ∈ Zp∗ such that R = gr, A = e(g, g)αn+1+a, where α is unknown. Hence, B can challenge A as follows. ∈ A B When receiving the plaintexts m0, m1 GT chosen by , randomly selects A B ∈ { } a bit b 0, 1 and computes the challenge ciphertext (c∗1 , c∗2 , c∗3) where c∗1 = h, c∗2 = hr, c3∗ = mbZe(g, h)a. claims that Z = e(gn+1, h) to answer the decision n-BDHE challenge if and only if ’s guess bit bj = b. ∈