11
$\begingroup$

I read on Wikipedia:

[...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute based encryption schemes.

Is this still the truth? I cannot find any newer sources for this. Is someone up-to-date on this?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
11
$\begingroup$

I am just going to answer regarding identity-based encryption (IBE): I don't know much about the situation for attribute-based encryption.

Also, I am just answering based on today's situation: recent IBE constructions may prove to be very efficient (or not) in the future, and if you want to consider only post-quantum schemes you will have to discard IBEs based on pairings, Diffie-Hellman and factoring.

Pairings

So first, pairing-based IBE is arguably the most studied and mature kind of IBE. The wireless sensor networks (WSN) community has shown great interest in using IBE (there even is a book on it), and there exist many implementations of IBE targeted for WSN: you can for example google TinyTate, TinyPBC or TinyPairing. Dan Boneh's company, Voltage (which has been bought by HP), also proposes pairing-based IBE.

Lattices

There exist a few IBE constructions, but as far as i know, only one public implementation (full disclosure: I am a co-author of this paper). It is faster (by an order of magnitude) but less efficient space-wise (secret keys and ciphertexts are about 4 KB).

Also, the encryption and decryption operations can be efficiently implemented on embedded devices (as they are based on Ring-LWE, they have been implemented, just not under the "IBE" tag). For key extraction, I know of no public implementation.

Other technologies

As far as I know, IBEs based on other technologies are less efficient than either pairing-based or lattice-based IBE (depending on the metric of efficiency you choose). This seems clear for IBEs based on quadratic residuosity. Very recently, IBEs have been introduced based on codes or the Diffie-Hellman assumption. There is no implementation proposed yet, so it is hard to give an educated opinion on their efficiency.

Conclusion

  • If your metric of efficiency is space, the most efficient solutions are pairing-based, but depending on what you consider "efficient" there exist alternatives.

  • If your metric is speed, it is not true that no other efficient implementation exist (lattice-based ones are faster).

  • If your metric is "the implementation must be on an embedded device", that leaves just pairings (and lattices if and only if you only need encryption and decryption to be on an embedded device).

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ I hope you don't mind that I embedded your references into your post for easier access. I appreciate all the work you did collecting them! If you don't approve, we can revert it. $\endgroup$
    – user47922
    Commented Jun 27, 2017 at 16:56
  • $\begingroup$ No problem, I actually find it much more practical with the embedded references :) $\endgroup$
    – Thomas Prest
    Commented Jun 28, 2017 at 11:12
  • $\begingroup$ Thank you both, for this collection and embedded links. :) It clears much up. But ABE is left. I can't imagin, that there is no draft for further progress in this area.. $\endgroup$
    – Shalec
    Commented Jun 28, 2017 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.