Our second scheme operates in the pay-per-query model without pairing and exponential operations. PAESS-I satisfies ciphertext indistinguishability and trapdoor indistinguishability, and sacrifices ...