Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-Policy Attribute-Based Encryption), also note that there is an error in the second step, it's $g^q(0)$ and not $h^q(0)$

decryptNode for leaf nodes


1 Answer 1


Since $H$ is a hash that projects into $\mathbb{G}_0$, one must be able to write $H(i)$ as $g^z$ for some unknown $z$, because $g$ is a generator of $\mathbb{G}_0$.

\begin{eqnarray*} \text{DecryptNode(CT,SK,}x\text{)} & = & \frac{e(D_i, C_x)}{e(D^{'}_i, C^{'}_x)} \\ & = & \frac{e(g^r\cdot H(i)^{r_i}, g^{q_x(0)})}{e(g^{r_i}, H(i)^{q_x(0)})} \\ & = & \frac{e(g^r, g^{q_x(0)})\cdot e(H(i)^{r_i}, g^{q_x(0)})}{e(g^{r_i}, H(i)^{q_x(0)})} \\ & = & \frac{e(g^r, g^{q_x(0)})\cdot e(g^{z r_i}, g^{q_x(0)})}{e(g^{r_i}, g^{z{q_x(0)}})} \\ & = & \frac{e(g, g)^{r{q_x(0)}}\cdot e(g, g)^{z r_i {q_x(0)}}}{e(g, g)^{r_i z{q_x(0)}}} \\ & = & e(g, g)^{r{q_x(0)}}. \end{eqnarray*}

The last step works because $e(g, g)^a\cdot e(g, g)^{-a} = 1$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.