In many encryption schemes in Charm the random group message is used instead of a text-message:

msg = group.random(GT)

For example, in CP-ABE scheme, random message is used:

cpabe = CPabe_BSW07(group)
msg = group.random(GT)  
attributes = ['ONE', 'TWO', 'THREE']

See link for scheme details: http://jhuisi.github.io/charm/charm/schemes/abenc/abenc_bsw07.html

Can anyone clarify for me whether I can use my own text-message instead of random ID here. I tried with a encoded byte-array but no luck. What is group.random(GT)? Can I use a custom message?


2 Answers 2


In real world applications Attribute-based Encryption (ABE) is used in conjunction with a symmetric cipher, because you can only encrypt group elements with ABE. In this case it is the multiplicative group $G_T$.

The number of bits is limited when you try to represent text messages (bit strings) with a group element, because the size of the group is derived from a prime. In Charm it is most likely 512 bit prime. You cannot represent messages that are bigger than any group element, if you would have a mapping function to map bit strings to group elements and back again.

Generally something else is done. It is called hybrid encryption in the context of ABE. The text message is encrypted using AES or other symmetric ciphers and the random key that was used is derived from the random $G_T$ element.

  1. Generate a random $G_T$ element with el = group.random(GT).
  2. Generate bytes from el e.g. like this extractor(el) or even hashlib.sha256(str(el)).digest() which can be directly used as the AES key.
  3. You would encrypt your text message with a symmetric cipher like AES-256 using the previously generated key.

Charm provides something for steps 2 and 3: SymmetricCryptoAbstraction.

The schemes that are implemented in Charm don't go this far to implement hybrid version of the scheme, because it would be the same for every one of them. It is unnecessary for the validation of the functionality of the scheme. This is why the message is just a random group element as a placeholder for a real world message.


The BSW07 CP-ABE scheme is a pairing based construction. Denoting the pairing as $e:G\times G\rightarrow G_T$ (symmetric notation for simplicity), the message space of this scheme is the prime order $q$ group $G_T$, which in practice is a prime order $q$ subgroup of the multiplicative group of some finite field.

Consequently, if you have a message $m$ and you want to encrypt it, you have to encode your message to an element of $G_T$. As I can see from the charm documentation, there is encoding functionality to group elements via group.encode(m).

If you want to encrypt messages using CP-ABE you should rely on hybrid encryption, i.e., use the ABE scheme to encrypt a random symmetric key $k$ (e.g., via group.encode(k)) and encrypt the message using this key with a symmetric encryption scheme.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.