Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Can someone explain what attribute based encryption is?

I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing aside from the papers.

share|improve this question

1 Answer 1

up vote 9 down vote accepted

I try to provide a brief intro.

ABE

Attribute-based encryption (ABE) is a relatively recent approach that reconsiders the concept of public-key cryptography. In traditional public-key cryptography, a message is encrypted for a specific receiver using the receiver’s public-key. Identity-based cryptography and in particular identity-based encryption (IBE) changed the traditional understanding of public-key cryptography by allowing the public-key to be an arbitrary string, e.g., the email address of the receiver. ABE goes one step further and defines the identity not atomic but as a set of attributes, e.g., roles, and messages can be encrypted with respect to subsets of attributes (key-policy ABE - KP-ABE) or policies defined over a set of attributes (ciphertext-policy ABE - CP-ABE). The key issue is, that someone should only be able to decrypt a ciphertext if the person holds a key for "matching attributes" (more below) where user keys are always issued by some trusted party.

Ciphertext-Policy ABE

In ciphertext-policy attribute-based encryption (CP-ABE) a user’s private-key is associated with a set of attributes and a ciphertext specifies an access policy over a defined universe of attributes within the system. A user will be ale to decrypt a ciphertext, if and only if his attributes satisfy the policy of the respective ciphertext. Policies may be defined over attributes using conjunctions, disjunctions and $(k,n)$-threshold gates, i.e., $k$ out of $n$ attributes have to be present (there may also be non-monotone access policies with additional negations and meanwhile there are also constructions for policies defined as arbitrary circuits). For instance, let us assume that the universe of attributes is defined to be $\{A,B,C,D\}$ and user 1 receives a key to attributes $\{A,B\}$ and user 2 to attribute $\{D\}$. If a ciphertext is encrypted with respect to the policy $(A \wedge C) \vee D$, then user 2 will be ale to decrypt, while user 1 will not be able to decrypt.

CP-ABE thus allows to realize implicit authorization, i.e., authorization is included into the encrypted data and only people who satisfy the associated policy can decrypt data. Another nice features is, that users can obtain their private keys after data has been encrypted with respect to policies. So data can be encrypted without knowledge of the actual set of users that will be ale to decrypt, but only specifying the policy which allows to decrypt. Any future users that will be given a key with respect to attributes such that the policy can be satisfied will then be ale to decrypt the data.

Key-Policy ABE

KP-ABE is the dual to CP-ABE in the sense that an access policy is encoded into the users secret key, e.g., $(A \wedge C) \vee D$, and a ciphertext is computed with respect to a subset of attributes, e.g., $\{A,B\}$. In this example the user would not be able to decrypt the ciphertext but would for instance be able to decrypt a ciphertext with respect to $\{A,C\}$.

An important property which has to be achieved by both, CP- and KP-ABE is called collusion resistance. This basically means that it should not be possible for distinct users to "pool" their secret keys such that they could together decrypt a ciphertext that neither of them could decrypt on their own (which is achieved by independently randomizing users' secret keys).

Beyond ABE

ABE in turn is just one type of the more general concept of functional encryption covering IBE, ABE and many other concepts from predicate encryption (inner product or hidden vector encryption yielding searchable encryption) etc.

share|improve this answer
4  
This is, by far, the best explanation I've got. Thank you very much for taking time to explain this in so much detail. I honestly believe that you should add this explanation to the wikipedia article of ABE as plenty of others can benefit from it. Thanks a lot once again. –  Mark Jun 25 at 21:54
    
Thx, feel free to do so :) –  DrLecter Jun 25 at 22:03
    
am curious if there is any work done in symmetric ABE schemes –  sashank Jun 26 at 4:47
    
@sashank I am not aware of any work in symmetric ABE. Naive CP-ABE could be: You have an authority that distributes a distinct key per attribute. If you have a policy just build the access tree and apply recursive secret sharing (as done in all constructions that do not use linear secret sharing) and encrypt the respective shares at the attribute leaves with the respective attribute keys. Use the random root secret that you have shared down the tree as a key to encrypt the data. However, this would not be collusion resistant, which may be hard to impossible to achieve in the symmetric setting. –  DrLecter Jun 26 at 6:30
    
@sashank I'm intrigued. What do you understand under symmetric ABE? If your idea is too long for a comment, meybe you can post a question. –  Artjom B. Jun 26 at 14:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.