10
$\begingroup$

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are.

My question is: what is the motivation/analogy behind Key-policy Attribute-based Encryption?

CPABE can be regarded as a variant of Attribute-based Access Control (ABAC) which is a well understood technique. What would be the KPABE equivalent, if there is one?

My take for an example key policy

$$(\text{Student}\wedge\text{Course}_A)\vee\text{Staff}$$

would be that $\text{Student}\wedge\text{Course}_A$ and $\text{Staff}$ can be seen as roles (RBAC) which will be activated through the attributes in the ciphertext. Is this an accurate analogy? Can you come up with a better one?

Improve this question
$\endgroup$

3 Answers 3

Reset to default
4
$\begingroup$

CP-ABE fits naturally with RBAC, whereas KP-ABE not so much. Better analogies can be made if you think of attributes as "tags" of the encrypted object/document, instead of the users. For instance, imagine a confidential document about nuclear weapons which is encrypted under the attributes NUCLEAR and TOPSECRET. Then, only a user with a key for attributes NUCLEAR and TOPSECRET can decrypt the document, while users with TOPSECRET keys and NUCLEAR keys cannot.

Improve this answer
$\endgroup$
1
  • $\begingroup$ It's OK :) I'm sure there are better motivating examples for KP-ABE. My point is that trying to think in terms of RBAC may be a little unnatural for this kind of schemes. $\endgroup$
    – cygnusv
    Commented Jul 25, 2014 at 10:36
5
$\begingroup$

I believe the answer cygnusv gave is not fully correct. If an object is tagged with "NUCLEAR, TOPSECRET" it can potentially be decrypted by someone not having the TOPSECRET attribute (or NUCLEAR attribute). Why? Because it all depends on the structure of the private keys in the system.

A private key could for example be: "NUCLEAR or SCIENCE LAB A". Thus it would suffice for the object to be tagged with NUCLEAR for this person to gain access.

This is also one of the reasons to why KP-ABE is "less intuitive" because the encryptor does not specify the relation between the attributes that are tagged. Instead it is the key authority (or just authority) which will decide how these attributes needs to be combined for access.

Improve this answer
$\endgroup$
1
  • $\begingroup$ So, in both KP and CP-ABE schemes, would it be fair to assume that the key authority and the data owner are separate entities? $\endgroup$
    – doughgle
    Commented Oct 24, 2018 at 9:49
0
$\begingroup$

KP-ABE suits the situation of passive users vs. active ciphertext, i.e., the ciphertext is pushed to users. An example is television program broadcasting where you want a fast encryption (tagging, instead of generating access policy is much more faster), and you can't control the number/identity of recipient.

CP-ABE on the other hand suits the active users vs. passive ciphertext, i.e., users actively looking for ciphertext. An example is cloud data, where you can tolerate with slower encryption, and you can decide who are the expected recipients.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I don't get it. (1) The performance depends on the private key size vs. the number of attributes used for ciphertext. If both are equal the encryption and decryption are more or less equal for many schemes. (2) I would think that KP-ABE is less suited for TV broadcasting from a performance viewpoint, because the tags can be quite numerous. Instead I would think that the actual process of tagging a specific TV show is trivial and can be done without much thought compared to deciding how the user's decryption policy should look. $\endgroup$
    – Artjom B.
    Commented Nov 12, 2018 at 19:04
  • $\begingroup$ I don't really understand you question, I try to reply: (1) CP-ABE's encryption algorithm needs to construct a policy tree for every ciphertext it generates, which is to recursively run a secret sharing scheme. But KP-ABE only do this operation once, during the Key Generation. (2) Yes there would be a lot combinations of attributes but this can be done offline, which does not affect the user experience. While transmitting encryption video needs to be fast, and complex encryption algorithm will slow down the streaming. Decryption wise, CP and KP ABE are similar, so nothing to compare on that. $\endgroup$
    – Tan
    Commented Dec 22, 2018 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.