Can someone explain what attribute based encryption is?

I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing aside from the papers.

  • 2
    $\begingroup$ Checkout this archive of gleamly's introduction to ABE. $\endgroup$ Commented Sep 28, 2015 at 15:38

1 Answer 1


I try to provide a brief intro.


Attribute-based encryption (ABE) is a relatively recent approach that reconsiders the concept of public-key cryptography. In traditional public-key cryptography, a message is encrypted for a specific receiver using the receiver’s public-key. Identity-based cryptography and in particular identity-based encryption (IBE) changed the traditional understanding of public-key cryptography by allowing the public-key to be an arbitrary string, e.g., the email address of the receiver. ABE goes one step further and defines the identity not atomic but as a set of attributes, e.g., roles, and messages can be encrypted with respect to subsets of attributes (key-policy ABE - KP-ABE) or policies defined over a set of attributes (ciphertext-policy ABE - CP-ABE). The key issue is, that someone should only be able to decrypt a ciphertext if the person holds a key for "matching attributes" (more below) where user keys are always issued by some trusted party.

Ciphertext-Policy ABE

In ciphertext-policy attribute-based encryption (CP-ABE) a user’s private-key is associated with a set of attributes and a ciphertext specifies an access policy over a defined universe of attributes within the system. A user will be ale to decrypt a ciphertext, if and only if his attributes satisfy the policy of the respective ciphertext. Policies may be defined over attributes using conjunctions, disjunctions and $(k,n)$-threshold gates, i.e., $k$ out of $n$ attributes have to be present (there may also be non-monotone access policies with additional negations and meanwhile there are also constructions for policies defined as arbitrary circuits). For instance, let us assume that the universe of attributes is defined to be $\{A,B,C,D\}$ and user 1 receives a key to attributes $\{A,B\}$ and user 2 to attribute $\{D\}$. If a ciphertext is encrypted with respect to the policy $(A \wedge C) \vee D$, then user 2 will be able to decrypt, while user 1 will not be able to decrypt.

CP-ABE thus allows to realize implicit authorization, i.e., authorization is included into the encrypted data and only people who satisfy the associated policy can decrypt data. Another nice features is, that users can obtain their private keys after data has been encrypted with respect to policies. So data can be encrypted without knowledge of the actual set of users that will be able to decrypt, but only specifying the policy which allows to decrypt. Any future users that will be given a key with respect to attributes such that the policy can be satisfied will then be able to decrypt the data.

Key-Policy ABE

KP-ABE is the dual to CP-ABE in the sense that an access policy is encoded into the users secret key, e.g., $(A \wedge C) \vee D$, and a ciphertext is computed with respect to a set of attributes, e.g., $\{A,B\}$. In this example the user would not be able to decrypt the ciphertext but would for instance be able to decrypt a ciphertext with respect to $\{A,C\}$.

An important property which has to be achieved by both, CP- and KP-ABE is called collusion resistance. This basically means that it should not be possible for distinct users to "pool" their secret keys such that they could together decrypt a ciphertext that neither of them could decrypt on their own (which is achieved by independently randomizing users' secret keys).

Beyond ABE

ABE is just one type of the more general concept of functional encryption (FE) covering IBE, ABE and many other concepts such as inner product or hidden vector encryption (yielding e.g., searchable encryption) etc. It is a very active and young field of research and has many interesting applications (in particular in the field of cloud computing).

  • 12
    $\begingroup$ This is, by far, the best explanation I've got. Thank you very much for taking time to explain this in so much detail. I honestly believe that you should add this explanation to the wikipedia article of ABE as plenty of others can benefit from it. Thanks a lot once again. $\endgroup$
    – Mark
    Commented Jun 25, 2014 at 21:54
  • $\begingroup$ am curious if there is any work done in symmetric ABE schemes $\endgroup$
    – sashank
    Commented Jun 26, 2014 at 4:47
  • 1
    $\begingroup$ @sashank I am not aware of any work in symmetric ABE. Naive CP-ABE could be: You have an authority that distributes a distinct key per attribute. If you have a policy just build the access tree and apply recursive secret sharing (as done in all constructions that do not use linear secret sharing) and encrypt the respective shares at the attribute leaves with the respective attribute keys. Use the random root secret that you have shared down the tree as a key to encrypt the data. However, this would not be collusion resistant, which may be hard to impossible to achieve in the symmetric setting. $\endgroup$
    – DrLecter
    Commented Jun 26, 2014 at 6:30
  • 1
    $\begingroup$ @sashank I'm intrigued. What do you understand under symmetric ABE? If your idea is too long for a comment, meybe you can post a question. $\endgroup$
    – Artjom B.
    Commented Jun 26, 2014 at 14:53
  • 2
    $\begingroup$ @sashank, one of the big benefits of ABE is that the attributes are public, and if you possess the attribute, you can get the private key associated with it. Thus, anyone can encrypt with the attributes, but only one who possesses them can decrypt. Symmetric ABE would say that only one who possesses the attributes can encrypt with them. If that is the functionality you need, you can get that with an attribute-based signcryption scheme. $\endgroup$
    – mikeazo
    Commented Jun 26, 2014 at 16:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.