In Boneh et. al.'s ABE scheme (https://eprint.iacr.org/2013/669.pdf, https://link.springer.com/content/pdf/10.1007/978-3-642-55220-5_30.pdf), the result value for the arithmetic function is selected and fixed to zero. In other words, if the arithmetic function is defined as $f(\mathbf{x})$, the user can decrypt if and only if $f(\mathbf{x})=0$. While this scheme can support any value of $y$. This means that we can use this scheme when the user can decrypt if and only if $f(\mathbf{x})=y$ which $y$ is a predefined fix value.
In the other word, key generation can be done by finding low-norm matrice $R_f$ such that $(A|yG+B_f).R_f=D$, instead of $(A|B_f).R_f=D$. This seems that works for any value of $y$ securely.
Also, this scheme works for any value of $y$ in Fully Homomorphic encryption. But this situation has not been considered for ABE.
Is that any security reason to fix the result value to zero?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ It is just a more convenient notation. You can convert any $f(x) = y$ to $g(x) = f(x) - y = 0$. $\endgroup$– LevCommented Sep 5, 2022 at 23:36
-
$\begingroup$ Thank you for your comment. But I mean that why did it use $(A|B_f)R_f=D$? While it can be worked by $(A|yG+B_f)R_f=D$ for any value of $y$. $\endgroup$– Mahdi MahdaviCommented Sep 6, 2022 at 11:25
Add a comment
|