Hot answers tagged

24

I try to provide a brief intro. ABE Attribute-based encryption (ABE) is a relatively recent approach that reconsiders the concept of public-key cryptography. In traditional public-key cryptography, a message is encrypted for a specific receiver using the receiver’s public-key. Identity-based cryptography and in particular identity-based encryption (IBE) ...


6

I purposefully did not look at the details of the change you are proposing because whatever the change is, the answer is a resounding YES. If you make any change to a cryptographic construction, then you must prove the security of the modified scheme. If you are lucky, you may be able to reduce the security of the modified scheme to the original scheme, or ...


4

There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write it additively $e(aP,bQ)=e(P,Q)^{ab}$. This comes from the fact that in $e : \mathbb{G}_1\times \mathbb{G}_2\to\mathbb{G}_T$, $\mathbb{G}_1$ and $\mathbb{G}_2$ ...


4

In real world applications Attribute-based Encryption (ABE) is used in conjunction with a symmetric cipher, because you can only encrypt group elements with ABE. In this case it is the multiplicative group $G_T$. The number of bits is limited when you try to represent text messages (bit strings) with a group element, because the size of the group is derived ...


3

Collusions are not possible here since each user's private keys are randomized. As you can see in the Key Generation function, for each user a random value $r$ is generated and embedded into all his private keys. Therefore, if you try to use private keys from different users, you will not be using the same random $r$ during the decryption process, so it will ...


3

There are ways to prevent Bob from having complete control over the randomness pool. You could use some form of verified randomness, where your function $f$ checks that the random string is signed before executing. This would work using, for instance, the NIST randomness beacon. You could also contain within $f$ a PRNG, so Bob does not need to provide all ...


3

The BSW07 CP-ABE scheme is a pairing based construction. Denoting the pairing as $e:G\times G\rightarrow G_T$ (symmetric notation for simplicity), the message space of this scheme is the prime order $q$ group $G_T$, which in practice is a prime order $q$ subgroup of the multiplicative group of some finite field. Consequently, if you have a message $m$ and ...


3

With IBE the public key is a public bitstring as your email. A Key-authority issues a secret key that is tied with this public key.The owner of the secret key can only decrypt. ABE entails more complex access control on decryption operation such as:"Only the owner of the secret key that corresponds to: Area:=Italy AND Age:<30 and Business:=Researcher" ...


3

This is a bilinear pairing used in cryptography. More precisely it's an evaluation of an appropriate pairing friendly elliptic curve equation.(1,2,3,4,5)


3

I believe the answer cygnusv gave is not fully correct. If an object is tagged with "NUCLEAR, TOPSECRET" it can potentially be decrypted by someone not having the TOPSECRET attribute (or NUCLEAR attribute). Why? Because it all depends on the structure of the private keys in the system. A private key could for example be: "NUCLEAR or SCIENCE LAB A". Thus it ...


3

CP-ABE fits naturally with RBAC, whereas KP-ABE not so much. Better analogies can be made if you think of attributes as "tags" of the encrypted object/document, instead of the users. For instance, imagine a confidential document about nuclear weapons which is encrypted under the attributes NUCLEAR and TOPSECRET. Then, only a user with a key for attributes ...


2

Surely bilinearity helps and and you have to be aware of the fact that $e(g^a,g^b)\cdot e(g^a,g^{-b})=e(g^a,g^b)\cdot e(g^a,g^b)^{-1}=1$. You see that from your last equation $$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$ you get $$=e(g^{a\...


2

If you need something that already exists, have a look at the advanced Crypto software collection and specifically cpabe — which implements ciphertext-policy attribute-based encryption scheme that uses C and PBC library for pairings.


2

I think you have a lack of knowledge on pairings and finite fields. Your definition of the pairing $e(X,Y)=g^{XY} \bmod p$ is not correct. A pairing is defined as a map $e : \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$ with the property \begin{align}\text{for all }g_1 \in \mathbb{G}_1 \text{ and } g_2 \in \mathbb{G}_2: e(g_1^a,g_2^b) = e(g_1,g_2)^{ab}\...


2

It means exactly what is written, the advantage of the adversary is a quantity which is defined as the difference between the probability that $b = b'$ and $1/2$. For example if the probability that $b = b'$ is $3/4$, then the advantage of the adversary is $3/4-1/2 = 1/4$.


2

The first Attribute-based Encryption scheme was introduced by Sahai and Waters in 2005: Fuzzy Identity-Based Encryption. It worked by associating a set of attributes with both the ciphertext and the private key of the user. Take for example the ciphertext which is encrypted with the attribute set $\{A, B, C\}$ and the private key of some user with the ...


2

Since $H$ is a hash that projects into $\mathbb{G}_0$, one must be able to write $H(i)$ as $g^z$ for some unknown $z$, because $g$ is a generator of $\mathbb{G}_0$. \begin{eqnarray*} \text{DecryptNode(CT,SK,}x\text{)} & = & \frac{e(D_i, C_x)}{e(D^{'}_i, C^{'}_x)} \\ & = & \frac{e(g^r\cdot H(i)^{r_i}, g^{q_x(0)})}{e(g^{r_i}, H(i)^{q_x(0)})} \\...


2

It is related to Cloud storage in the sense that you don't have to trust the server you put your data on. Usually, the access control is done via authentication. This requires the server to be trusted. However in the case of Cloud storage, you don't know anything about the server hosting the data, so being able to do access control with the encryption ...


2

At first, the abbreviation “ABBE” is used by Zhou et al. in [2] as a name for his ABE scheme. Zhou builds on top of a CP-ABE scheme which in addition supports “constant” ciphertexts (named CCP-ABE). From this perspective ABBE is a specific ABE scheme based on CP-ABE supporting constant ciphertexts. However, in a more general way, I see ABE in the context of ...


2

I suggest, you look into the code how that works. Basically, you start with a secret that you want to share according to some tree. You share the secret with a Threshold Secret Sharing Scheme like Shamir's Secret Sharing and put the resulting shares into the children of that node (in the beginning this is the root node). Then you can re-share each of the ...


1

Composite-order groups for pairings are sometimes a necessary tool provide a proof for adaptive security. Most schemes for prime-order groups only reach selective security in their respective security models. While the security generally increases, the performance of composite-order group pairings decreases heavily. Compare prime-order pairings of Type A ...


1

Short refresher on KP-ABE: The Master Secret Key (MSK) and the Public Parameters (PP) are created during Setup and both enable the attribute authority to create Secret Keys (SK) for users using the Keygen algorithm. Some user who possesses PP can Encrypt some data with a set of attributes $\gamma$. The encryption works by generating a new random secret $s$...


1

Different researchers use different notations for elliptic curve bilinear pairing groups. For symmetric pairing this can look like: $e: \; \mathbb{G} \times \mathbb{G} \rightarrow \mathbb{G}_T$ $e: \; \mathbb{G}_1 \times \mathbb{G}_1 \rightarrow \mathbb{G}_T$ $e: \; \mathbb{G}_1 \times \mathbb{G}_1 \rightarrow \mathbb{G}_2$ $e: \; \mathbb{G}_1 \times \...


1

Assuming that $M_T$ is the order of $g$, then it's real easy to compute $(D)^{\%M_T}$: it's the value $D$. That is, if $M_T$ is the order of $g$, then we have the identity $g^x = g^{x \bmod M_T}$ for any $x$, and in particular, $g^{r + M_S} = g^{(r + M_S) \bmod M_T}$. The paper is just noting that the $\bmod$ operation happens implicitly here. BTW: I've ...


1

Let's assume that we're talking about monotonic access structures (without negated attributes in the policy). A Threshold policy was introduced in Sahai, Amit, and Brent Waters. "Fuzzy identity-based encryption." Advances in Cryptology–EUROCRYPT 2005. Springer Berlin Heidelberg, 2005. 457-473. (link) It means that a user secret key and the ciphertext are ...


1

Layering your encryption mechanisms like that would not display collusion-resistance between the two schemes. For example, someone with an Org-A key could decrypt the outer encryption over a record designated for Org-A administrators and then pass the inner ciphertext to someone with an Administrator key. Of course, you could use a different key for each Org'...


1

My understanding of this is as follows: Monotonic access structure: if $\mathbb{A}$ is a set of attributes satisfying an access structure $T$, then any $\mathbb{A}'$ such that $\mathbb{A} \subset \mathbb{A}'$ also satisfies $T$. For example, consider $T = A \cap B$, then both $\mathbb{A}=\{A,B\}$ and $\mathbb{A}'=\{A,B,C\}$ satisfy $T$. Non-monotonic ...


1

Simply speaking, if any superset of the set satisfying the access structure satisfies the access structure, we call the structure monotonic. Let $\{1,2,...,n\}$ be a set of indices. An access structure is a collection $\mathbb{A}$ of non-empty subsets of $\{1,2,3,...,n\}$. We say a collection (or an access structure) $\mathbb{A} \subseteq 2^{\{1,2,...,n\}}$ ...



Only top voted, non community-wiki answers of a minimum length are eligible