Algorithm 2: Decryption protocol performed by $V_a$

Input: $C=\langle U,V,W\rangle ,S_{(a,i)}^j$ 1: Compute ${\mathrm{\Gamma }}_{(a,i)}^j=U\oplus V^{S_{(a,i)}^j}$ 2: Retrieve $M=W\oplus H_1(e({\sigma }_a^{j}P,{\mathrm{\Gamma }}_{(a,i)}^{j}P))$