國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
is shown in the pseudo-code expression. In the beginning, the simulator initializes an empty hash table 𝜏, a set of public parameter 𝑝𝑝 and the key pair (𝑠𝑘, 𝑝𝑘); and the adversary outputs his public key 𝑝𝑘• on receiving parameters (𝑝𝑝, 𝑝𝑘). Then, the adversary is allowed to request hash oracle 𝒪•¡, trapdoor oracles 𝒪™, 𝒪™1 and decryption oracles 𝒪Š , 𝒪Š¡. The simulator will answer them as shown. Finally, if the adversary outputs 𝑚 where 𝑒 𝑔ˆ, 𝑚 = 𝑒(𝑔ˆŒ, 𝑔), it breaks the OW-CCA2 of PKE-AET; and meanwhile, the simulator breaks the CONF assumption by outputting 𝑔Œ ← 𝑚.
By the intractability of the CONF assumption, it is said that PKE-AET is OW-CCA2 secure.
Theorem 9: PKE-AET is IND-CCA2 secure against type-II adversaries in the RO model.
Proof. Assume that there is an adversary who is able to break the IND-CCA2 security of PKE-AET with non-negligible probability in the random oracle model, it can be demonstrated that how one simulator may utilize the adversary to break the CDH assumption (given 𝑔ˆ, 𝑔Œ ∈ 𝔾, find 𝑔ˆŒ, defined in section 2.1.2) with non-negligible probability. Let Pr [𝐸𝑥𝑝?] be the probability the adversary wins the experiment 𝐸𝑥𝑝?. A series of experiments and the difference lemma [82] will be adopted to gradually proof the security.
Experiment 𝐸𝑥𝑝Í: A simulator initializes the public parameters 𝑝𝑝 and a pair of keys 𝑠𝑘, 𝑝𝑘 in the beginning. Then, it passes 𝑝𝑝, 𝑝𝑘 to the adversary to begin the experiment. When the decryption oracle 𝒪Š (𝐶) is requested, it returns 𝐷𝑒𝑐(𝑠𝑘, 𝐶); when the decryption oracle 𝒪Š¡(𝐶) is requested, it returns 𝒪Š (𝐶) if 𝐶 ≠ 𝐶Ï. The challenge 𝐶Ï ← 𝐸𝑛𝑐(𝑝𝑘, 𝑚Ï) is the encryption of one of messages (𝑚Í, 𝑚•) outputted by the adversary. Obviously, 𝐸𝑥𝑝Í is identical the PKE-AET scheme. The probability is estimated as follow.
𝐴𝑑𝑣𝒜,»¸Ë°ÂË™ÎxŠ°ŽŽÂ— = Pr 𝐸𝑥𝑝Í = Pr
𝑝𝑝 ← 𝑆𝑒𝑡𝑢𝑝 1É ; 𝑠𝑘, 𝑝𝑘 ← 𝐾𝐺𝑒𝑛 𝑝𝑝 ; (𝑚Í, 𝑚•) ← 𝒜𝒪Ð (∙)(𝑝𝑝, 𝑝𝑘);
𝑏 $ 0, 1 ; 𝐶Ï ← 𝐸𝑛𝑐 𝑝𝑘, 𝑚Ï ; 𝑏′ ← 𝒜𝒪С ∙ 𝑝𝑝, 𝑝𝑘, 𝐶Ï : b = b′
−1 2
(40)
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Experiment 𝐸𝑥𝑝•: It is mainly the same as 𝐸𝑥𝑝Í except the hash functions are replaced by random oracle accesses. Two hash tables 𝜏•, 𝜏— ←⊥ are initialized in the beginning of 𝐸𝑥𝑝•. When a hash query 𝒪• 𝑑• or 𝒪•¡ 𝑑— is queried, the simulator checks data on table 𝜏• or 𝜏—, if there is already a record 𝑑•, ℎ• ∈ 𝜏• or 𝑑—, ℎ— ∈ 𝜏—, it returns the recorded hash value; if no record is found, it randomly picks a random value ℎ• $ 𝔾 or ℎ— $ 0, 1 Wܼ, saves 𝑑•, ℎ• or 𝑑—, ℎ— on table 𝜏• or 𝜏—, and returns hash value ℎ• or ℎ—, respectively. The hash functions in the encryption process and decryption oracles 𝒪Š ∙ and 𝒪Š¡ ∙ are substituted by random oracles as well. By the definition of the random oracle:
Pr 𝐸𝑥𝑝Í = Pr 𝐸𝑥𝑝• = Pr
𝑝𝑝 ← 𝑆𝑒𝑡𝑢𝑝 1É ; 𝑠𝑘, 𝑝𝑘 ← 𝐾𝐺𝑒𝑛 𝑝𝑝 ; (𝑚Í, 𝑚•) ← 𝒜𝒪Ð (∙)𝒪) (∙)𝒪)¡(∙)(𝑝𝑝, 𝑝𝑘);
𝑏 $ 0, 1 ; 𝐶Ï← 𝐸𝑛𝑐 𝑝𝑘, 𝑚Ï ;
𝑏′ ← 𝒜𝒪С ∙ 𝒪) ∙ 𝒪)¡ ∙ 𝑝𝑝, 𝑝𝑘, 𝐶Ï : b = b′ (41)
Experiment 𝐸𝑥𝑝—: It is mainly the same as 𝐸𝑥𝑝• except that the challenge is modified as 𝐶Ï ← (𝑔ƒ, 𝑅•, 𝑅—) where 𝑟 $ ℤW∗, 𝑅• $ 𝔾 and 𝑅— $ 0, 1 Wܼ. Then, two records (𝑔•ƒ, 𝑅•/𝑚σ) and (𝑔σ, 𝑅—⊕ (𝑚Ï||𝑟)) are added to hash tables 𝜏• and 𝜏—, respectively. It is inherently identical to 𝐸𝑥𝑝• by the definition of random oracle. Experiment 𝐸𝑥𝑝— reveals an interesting idea that ciphertext or challenge could actually be totally composed of randomness if the related hash records are correctly recorded in the hash tables. The probability of Pr 𝐸𝑥𝑝— is shown below.
Pr 𝐸𝑥𝑝• = Pr 𝐸𝑥𝑝— = Pr
𝑝𝑝 ← 𝑆𝑒𝑡𝑢𝑝 1É ; 𝑠𝑘, 𝑝𝑘 ← 𝐾𝐺𝑒𝑛 𝑝𝑝 ; (𝑚Í, 𝑚•) ← 𝒜𝒪Ð (∙)𝒪) (∙)𝒪)¡(∙)(𝑝𝑝, 𝑝𝑘);
𝑏 $ 0, 1 ; 𝑟 $ ℤW∗, 𝑅• $ 𝔾; 𝑅— $ 0, 1 Wܼ; 𝜏•. 𝑎𝑑𝑑((𝑔•ƒ, 𝑅•/𝑚σ));
𝜏—. 𝑎𝑑𝑑((𝑔σ, 𝑅—⊕ (𝑚Ï||𝑟)));
𝐶Ï← (𝑔σ, 𝑅•, 𝑅—);
𝑏′ ← 𝒜𝒪С ∙ 𝒪) ∙ 𝒪)¡ ∙ 𝑝𝑝, 𝑝𝑘, 𝐶Ï : 𝑏 = 𝑏′
(42)
‧
Experiment 𝐸𝑥𝑝Þ: It is mainly the same as 𝐸𝑥𝑝— except for following modifications related to the CDH assumption (given 𝑔ˆ, 𝑔Œ ∈ 𝔾, find 𝑔ˆŒ). The detail simulation is described in form of pseudo codes illustrated in Figure 19. Four main modifications are listed below.
Figure 19: The simulated IND-CCA2 game of PKE-AET.
1. The public key. Let 𝑎, 𝑏 $ ℤW∗, the new public key is replaced by 𝑝𝑘 ← 𝑔ˆ •, 𝑔ˆ Ï . 2. The decryption oracle. Let 𝑈, 𝑉, 𝑊 ← 𝐶 and 𝜂 ←⊥. For all 𝑑•, ℎ• ∈ 𝜏•, set 𝜂[𝑉/
𝑑•] ← 𝑇𝑟𝑢𝑒 . For all 𝑑—, ℎ— ∈ 𝜏—, computes 𝑚||𝑟 ← 𝑊 ⊕ ℎ—; if (𝑈 = 𝑔ƒ∧ 𝜂[𝑚ƒ] ), returns 𝑚 as the decryption result. If no matched record found, it returns ⊥.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
3. The hash oracle checks. Owing to the fact that the CDH problem is imported into 𝐸𝑥𝑝Þ, a check is executed before returning the hash values. If the adversary requests a hash query 𝒪• (𝑔•ˆŒ) or 𝒪•¡(𝑔ψŒ), the simulator will not be able to return a convincing answer to the adversary and the simulation will fail. Let it be event 𝐸. When revising the description in Experiment 𝐸𝑥𝑝—, the ciphertexts could be composed of randomness and the experiment still works if some hash records are correctly recorded. But in this Experiment 𝐸𝑥𝑝Þ, these records cannot be recorded due to the hardness of the CDH problem. If event 𝐸 happens, the simulator aborts the simulated experiment and outputs 𝑔ˆŒ ← 𝑑••ø or 𝑔ˆŒ ← 𝑑—Ïø to break the CDH problem.
4. The challenge. The challenge is set to 𝐶Ï ← (𝑔Œ, 𝑅•, 𝑅—) where 𝑅• $ 𝔾 and 𝑅— $ 0, 1 Wܼ.
The probability Pr [𝐸𝑥𝑝—] is going to be discussed based on probabilities Pr [𝐸𝑥𝑝Þ] and Pr [𝐸].
• If the adversary ever requests 𝒪• (𝑔•ˆŒ) or 𝒪•¡(𝑔ψŒ) that might cause failure, the simulated 𝐸𝑥𝑝Þ will fail. But in this condition the simulator can break the CDH problem by outputting 𝑔ˆŒ ← 𝑑••ø or 𝑔ˆŒ ← 𝑑—Ïø . The probability of event 𝐸 is estimated as (𝑞• + 𝑞•¡)𝐴𝑑𝑣𝒜,𝔾ŽŠ•,𝔾* where 𝑞• and 𝑞•¡ are the access limits of 𝐻• and 𝐻—, respectively.
• If above event doesn’t occur, no information about 𝑚Ï is hidden in the challenge 𝐶Ï, the probability Pr [𝐸𝑥𝑝Þ] is 1/2 for any adversary.
By the difference lemma [82], the probability Pr [𝐸𝑥𝑝—] is estimated as Pr 𝐸𝑥𝑝— ≤•—+ 𝐴𝑑𝑣𝒜,𝔾ŽŠ•,𝔾*. Then, combining equation
(45) to (47), the probability 𝐴𝑑𝑣𝒜,»¸Ë°ÂË™ÎxŠ°ŽŽÂ— is estimated as
𝐴𝑑𝑣𝒜,»¸Ë°ÂË™ÎxŠ°ŽŽÂ— = Pr 𝐸𝑥𝑝Í −1
2= Pr 𝐸𝑥𝑝• −1
2≤ (𝑞• + 𝑞•¡)𝐴𝑑𝑣𝒜,𝔾ŽŠ•,𝔾*
(43)
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
As a result, by the intractable of the CDH problem, it is said that PKE-AET is IND-CCA2 secure against unauthorized type-II adversaries in the random oracle model.
Discussion
So far, all PKEET schemes suffer from a problem that their security against type-I adversaries, or so called authorized users, may not be indistinguishable. A simple and general demonstration below shows that the indistinguishability is unachievable for most PKEET schemes. In any indistinguishable game, the adversary outputs two messages 𝑚Í, 𝑚• to the simulator and one of them is encrypted into the challenge 𝐶Ï. Then, the adversary requests trapdoor oracle to acquire a permanent or cipher-bound trapdoor. Next, it encrypts 𝑚• into 𝐶•∗ and executes 𝑇𝑒𝑠𝑡(𝐶Ï, 𝐶•∗, 𝑇) with its trapdoor. Finally, the answer 𝑏 ← 𝑇𝑒𝑠𝑡(𝐶Ï, 𝐶•∗, 𝑇) is easily obtained. That is why the security proof has to be discussed in two categories. After analyzing the reason why no known PKEET scheme can defend this attack, a conclusion was obtained: the adversary always obtains the trapdoor he needs. If this condition can be avoided, the security notion will be much better than just one-way security. Following, in the next research paper, a PKEET solution will be introduced, which is provable indistinguishable in the standard model that means the random oracle model is no longer needed while proofing the security. On the other hand, it could be proved indistinguishable even against the authorized users so that the categories type-I and type-II are also no longer required.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
4.4 Semantic secure equality test
Following the discussion of the previous page, there is no known PKEET scheme before this work that can be proved IND-CCA2 secure, or so called semantic secure. Hence, it was quite remarkable when the first semantic secure PKEET solution was proposed. Informally speaking, the proposed PKE-FET framework is similar to other PKEET schemes, including 𝑆𝑒𝑡𝑢𝑝, 𝐾𝐺𝑒𝑛, 𝐸𝑛𝑐, 𝐷𝑒𝑐, 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟 and 𝑇𝑒𝑠𝑡. The spotlight focuses on how the trapdoor is designed for better security. In previous works, the trapdoor is valid for all ciphertext or for a specific ciphertext, and the adversary in the simulated security games knows that the given trapdoor definitely works with the challenge ciphertext. The newly designed trapdoor breaks this. In the PKE-FET syntax (illustrated in Figure 20), a receiver picks several messages to generate a trapdoor that only makes these messages equality testable; and these messages are intractable from the trapdoor. In the viewpoint of the adversary, the trapdoor is valid for only few unknown messages. The detail discussion begins with the definition of the new syntax PKE-FET.
Figure 20: The flowchart of filtered equality test
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Syntax of PKE-FET
• 𝑆𝑒𝑡𝑢𝑝 1¼ : On input a secure parameter 𝜅, public parameters 𝑝𝑝 are generated for public usage.
• 𝐾𝐺𝑒𝑛(𝑝𝑝): A user picks a pair of private key and public key (𝑠𝑘, 𝑝𝑘) through the public parameters 𝑝𝑝, where the public key is published and the private key is securely kept.
• 𝐸𝑛𝑐(𝑝𝑘, 𝑚): The sender uses the receiver’s public key to encrypt a message 𝑚 into a testable ciphertext 𝐶.
• 𝐷𝑒𝑐(𝑠𝑘, 𝐶): The receiver can decrypt the acquired ciphertext 𝐶 with its secret key and then obtain the hidden message 𝑚.
• 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟(𝑠𝑘, 𝑴): The receiver firstly picks several messages, say group 𝑴, then it outputs a trapdoor 𝑇 ← 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟(𝑠𝑘, 𝑴). This trapdoor is valid only when the inputted message 𝑚 ∈ 𝑴.
• 𝑇𝑒𝑠𝑡 𝐶Í, 𝐶•, 𝑇Í, 𝑇• : Let 𝐸𝑛𝑐 𝑝𝑘Í, 𝑚Í ← 𝐶Í , 𝐸𝑛𝑐 𝑝𝑘•, 𝑚• ← 𝐶• , 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟 𝑠𝑘Í, 𝑴Í ← 𝑇Í and 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟 𝑠𝑘•, 𝑴• ← 𝑇•, on input two ciphertexts and their receivers’ trapdoors, the authorized user can verify the equivalence between two ciphertexts if 𝑚Í ∈ 𝑴Í and 𝑚• ∈ 𝑴•. After the equality test, the algorithm outputs 1 for 𝑚Í ∈ 𝑴Í, 𝑚• ∈ 𝑴• and 𝑚Í = 𝑚•; or 0, otherwise.
𝐴𝑑𝑣𝒜,»¸Ë°”Ë™ÎxŠ°ŽŽÂ— (𝜅)123Pr
𝑝𝑝 ← 𝑆𝑒𝑡𝑢𝑝 1É ; 𝑠𝑘, 𝑝𝑘 ← 𝐾𝐺𝑒𝑛 𝑝𝑝 ; 𝑴 $ ℳ; 𝑇 ← 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟 𝑠𝑘, 𝑴 ;
(𝑚Í, 𝑚•) ← 𝒜𝒪Ð ∙ (𝑝𝑝, 𝑝𝑘, 𝑇);
𝑏 $ 0, 1 ; 𝐶Ï ← 𝐸𝑛𝑐 𝑝𝑘, 𝑚Ï ; 𝑏′ ← 𝒜𝒪С ∙ 𝑝𝑝, 𝑝𝑘, 𝑇, 𝐶Ï : 𝑏 = 𝑏′
−1 2
(44)
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Security notion
The IND-CCA2 security4 is quite similar to that defined in section 3.1.2. In addition, the trapdoor is given to the adversary when the experiment starts with receiving the public parameters 𝑝𝑝 and the public key 𝑝𝑘. A PKE-FET scheme is IND-CCA2 secure if 𝐴𝑑𝑣𝒜,»¸Ë°”Ë™ÎxŠ°ŽŽÂ— 𝜅 is negligible.
The implementation of the PKE-FET scheme relies on the cooperation of bilinear mapping and the secret sharing technology, both of which were defined in chapter 2.
• 𝑆𝑒𝑡𝑢𝑝(1¼): On input a secure parameter 𝜅, a type-III bilinear pairing {𝑒: 𝔾• × 𝔾— → 𝔾™, 𝑔•, 𝑔—, 𝑞} is generated where 𝑔• ∈ 𝔾•, 𝑔— ∈ 𝔾— denote generators of 𝔾• and 𝔾—, respectively; and 𝑞 stands for the order of 𝔾•, 𝔾— and 𝔾™. Two collision-resistant and one-way hash functions 𝐻•: 𝔾 → 𝔾™ and 𝐻—: 0, 1 ∗ → ℤW∗ are required. The message space ℳ is set identical to group 𝔾. Another secure parameter 𝑛 (𝑛 ≪ ℳ = 𝑞) that regulates the maximum size of message sets hidden in the trapdoors is required. The outputted public parameters are 𝑝𝑝 ← {𝑒, 𝔾•, 𝔾—, 𝔾™, 𝑔•, 𝑔—, 𝑞, 𝐻•, 𝐻—, 𝑛}.
• 𝐾𝑒𝑦𝐺𝑒𝑛(𝑝𝑝) : On input the public parameters 𝑝𝑝 , a user randomly picks (𝑘, 𝑙, 𝑠Í, … , 𝑠?) $ ℤW∗ as its private key and publishes the public key (𝐾, 𝐿, 𝑆Í, … 𝑆?) where 𝐾 ← 𝑔•~, 𝐿 ← 𝑒 𝑔•, 𝑔— ~î and 𝑆„ ← 𝑔•Ýì for all 𝑖 ∈ [0, 𝑛].
• 𝐸𝑛𝑐(𝑝𝑘, 𝑚): To encrypt a message 𝑚 ∈ 𝔾•, a sender randomly picks 𝑟 $ ℤW∗ and outputs 𝐶 ← (𝑈, 𝑉, 𝑊, 𝑿) where 𝑈 ← 𝑔•ƒ, 𝑉 ← 𝑚𝐾ƒ and 𝑊 ← 𝐿ƒ𝐻•(𝑚). Set 𝑿 is composed of 𝑿 ← (𝑋Í, … , 𝑋?) where ℎ ← 𝐻—(𝑚) and 𝑋„ ← 𝑆„ƒ;ì for all 𝑖 ∈ [0, 𝑛].
4 The probability 𝐴𝑑𝑣𝒜,»¸Ë°”Ë™ÎxŠ°ŽŽÂ— 𝜅 is defined without consideration about the trapdoor oracle and the test oracle. Whereas, the adversary might or might not acquire useful information if those two oracle accesses are available. If one day, the trapdoor oracle is taken into consideration, the key pair of the receiver has to change in each session, and it has to be ensured that the adversary has to output 𝑤Í, 𝑤• in a session without trapdoor oracle. The practical setting among key pairs, sessions, and trapdoor oracles is quite complicated so that it is kept as a future work.
‧
[0, 𝑛]. Note that the message set 𝑴 and coefficients 𝑎„ are unknown to the testers.• 𝑇𝑒𝑠𝑡(𝐶Í, 𝐶•, 𝑇Í, 𝑇•) : Let 𝐶Í ← (𝑈Í, 𝑉Í, 𝑊Í, 𝑿Í) , 𝐶• ← (𝑈•, 𝑉•, 𝑊•, 𝑿•) , 𝑇Í,Í, … , 𝑇Í,? ← 𝑇Í and 𝑇•,Í, … , 𝑇•,? ← 𝑇•, the filtered equality test follows the steps below.
1. Parse 𝑿Í and 𝑿• as (𝑋Í,Í, … , 𝑋Í,?) ← 𝑿Í and (𝑋•,Í, … , 𝑋•,?) ← 𝑿•. 2. Compute 𝑍Í ← 𝑊Í/ ?„ØÍ𝑒(𝑋Í,„, 𝑇Í,„) and 𝑍• ← 𝑊•/ ?„ØÍ𝑒(𝑋•,„, 𝑇•,„). 3. Output 1 if 𝑍Í = 𝑍•; or output 0, otherwise.
The decryption process is straightforward so that it is omitted. For the second step of algorithm 𝑇𝑒𝑠𝑡, a brief inference might help understand. The computation is symmetric so that symbols 𝐶Í 𝑇Í, 𝑈Í, 𝑉Í and 𝑊Í are replaced by 𝐶, 𝑇, 𝑈, 𝑉 and 𝑊, respectively; 𝑋Í,„ and 𝑇Í,„ are substituted with 𝑋„ and 𝑇„, respectively. The same replacements are applied to those variables on the other side like 𝐶• 𝑇•, 𝑈•, 𝑉•, 𝑊•, 𝑋•,„ and 𝑇•,„. second step of algorithm 𝑇𝑒𝑠𝑡 becomes:
‧
• Perfect consistency: By equation (46), the comparison between 𝑍Í and 𝑍• is actually the comparison between 𝐻• 𝑚Í and 𝐻• 𝑚• in case both condition I and II hold. The consistency definitely holds because 𝑚Í = 𝑚• implies 𝐻• 𝑚Í = 𝐻• 𝑚• .
• Computational soundness: Two scenarios are taken into consideration as follows.
o Condition I and II hold, but condition III fails. By the collision resistant property, it is computationally hard to find 𝑚Í ≠ 𝑚• and 𝐻• 𝑚Í = 𝐻•(𝑚•) . The probability is estimated as 𝐴𝑑𝑣𝒜,•Ž« (𝜅). It is defined in section 2.2.1.
o At least one of condition I or II fails. Since function 𝑓(𝑚Í) or 𝑓(𝑚•) is unpredictable, the false positive probability is estimated as 𝑞°•.
It is clear that the computation of filtered equality test is not that efficient because of the belongingness verification is heavy. When it is compared with previous PKEET works (depicted in Table 5), despite 𝑛 ≪ |𝔾|, the computation complexity of PKE-FET is higher than other PKEET works. The spotlight is that it is IND-CCA2 secure against no matter type-I and type-II adversaries.
Table 5: Comparison between PKE-FET and previous PKEET schemes.
AoN-PKEET[77] PKE-DET[78] PKE-AET[81] PKE-FET
Efficiency 𝐾𝐺𝑒𝑛 𝑂(1) 𝑂(1) 𝑂(1) 𝑂(𝑛)
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Trapdoor 𝑂(1) 𝑂(1) 𝑂(1) 𝑂(𝑛)
Trapdoor Scope 𝔾 𝔾 𝔾 or 1 𝑛
Security W/O trapdoor One-way One-way One-way IND
With trapdoor IND IND IND IND
Security proof
The efficiency is not good among all PKEET schemes, but the security is outstanding. Following, the security proof will focus on the security against type-I adversaries (authorized users), which implies the security against type-II adversaries (unauthorized users).