Security Proof for XXX in the ROM. To show the security of XXX in the ROM we use and adapt the results of Alwen et al. [3] on Generalized Selective Decryption (GSD) to the USKE setting for our purposes: 0 Definition 19 (Generalized Selective Decryption (GSD), adapted from [3, 26]). Let (UEnc, UDec) be a USKE scheme with secret key space K and message space M such that K ⊆ M. The GSD game (for USKE schemes) is a two-party game between challenger C and an adversary A. On input an integer N, for each v ∈ [N ] the challenger C picks a uniformly random initial key kv and intializes the key graph G = (V, E) := ([N ], ∅) and the set of corrupt users C = ∅. A can adaptively issue the following queries: – (encrypt, u, v): On input two nodes u and v, C returns an encryption (ku , c) ← UEnc(ku, kv) of the 0-th version of the key at node v, kv, under the current version of the key at node u, ku, adds the directed edge (u, v) to E , and replaces the current version of ku at u with new version ku . Each pair (u, v) can only be queried at most once. – (corrupt, v): On input a node v, C returns kv, the current version of the key at node v and adds v
Security Proof for XXX in the ROM. To show the security of XXX in the ROM we use and adapt the results of Xxxxx et al. [3] on Generalized Selective Decryption (GSD) to the USKE setting for our purposes: A M K ⊆ M K Definition 17 (Generalized Selective Decryption (GSD), adapted from [3, 26]). Let (UEnc, UDec) be a USKE scheme with secret key space and message space such that . The GSD game (for USKE schemes) is a two-party game between challenger C and an adversary . On input an integer N, for each 0 5 u S ∅ C ∅ A ∈ v [N ] the challenger C picks a uniformly random initial key ky and intializes the key graph = ( , ) := ([N ], ) and the set of corrupt users = . can adaptively issue the following queries:
