1
$\begingroup$

I have three questions regarding CP-ABE:

1) Is it correct to assume that in this scheme there is only one public key? Private keys are generated based on one's attributes that I do understand, by the authority.

Previously I thought I would be able to generate one's public key based on one's attribute (identity ID for example) and encrypt data with one's public key which I generated based on recipient's ID. But now I see it was wrong thinking, you need to encrypt data with a public key, which is only one throughout the lifetime of the system, and the encryption mechanism just takes into account the values of attributes which you've specified. Is that correct?

2) If above holds true and there is only one global public key based on a global secret then I assume there's no way for message originator to sign his message under this scheme. So that a recipient could verify that the message originator is really the one in possession of a given attribute (such as Id). I'm thinking of ways of implementing authentication under this scheme.

3) If one encrypts a message under specific access structure parameter values are these values in plaintext? I mean if one encrypts a message under attribute ID value '11' is everyone else able to see who the recipient actually is? I mean are they able to read the value '11'.

Improve this question
$\endgroup$
2
  • $\begingroup$ Do you mean "one public key" total or "one public key" per attribute? $\endgroup$
    – mikeazo
    Aug 25, 2016 at 12:16
  • $\begingroup$ I mean one public key total, as I wrote "only one global public key". One public key total and multiple private keys based on one's attributes. but a single private key per attribute set. correct? $\endgroup$
    – Vega4
    Aug 25, 2016 at 13:42

1 Answer 1

Reset to default
2
$\begingroup$

1) Is it correct to assume that in this scheme there is only one public key? Private keys are generated based on one's attributes that I do understand, by the authority.

No, each attribute is a public key. When you are encrypting a message, you form the access policy using the public keys of the various attributes needed from your policy.

2) If above holds true and there is only one global public key based on a global secret then I assume there's no way for message originator to sign his message under this scheme. So that a recipient could verify that the message originator is really the one in possession of a given attribute (such as Id). I'm thinking of ways of implementing authentication under this scheme.

The above does not hold true, but I wanted to comment. Researchers have developed other primitives for attribute based signing. There has also been research published on attribute based signcryption, which combines the two.

3) If one encrypts a message under specific access structure parameter values are these values in plaintext? I mean if one encrypts a message under attribute ID value '11' is everyone else able to see who the recipient actually is? I mean are they able to read the value '11'.

Under the original constructs, the access policy was public. So if you got a hold of a ciphertext and the policy, you could determine what attributes are necessary for decryption. Since then, researchers have developed methods to allow you to hide or keep private certain attributes in an access policy.

Improve this answer
$\endgroup$
7
  • $\begingroup$ thank you for addressing all of my question and pointing me these two artciles. your answer has been of tremendous help. $\endgroup$
    – Vega4
    Aug 25, 2016 at 14:26
  • $\begingroup$ just one more thing. Lets say there is an attribute ID. Is is true that it is NOT required at the setup-stage to define EVERY possible value of ID? or does adding a new possibility to the space of possible ID-values require reissuance of all of the private keys related to to that atrribute. $\endgroup$
    – Vega4
    Aug 25, 2016 at 14:35
  • $\begingroup$ @Vega4, this is stretching my knowledge here, but I believe that in some ABE systems you do not have to have every ID known a priori, but maybe just an upper bound on the number of IDs. I'll see if I can find any examples, however. $\endgroup$
    – mikeazo
    Aug 25, 2016 at 14:44
  • $\begingroup$ Check out section 5 of this paper. It talks about large-universe constructions. $\endgroup$
    – mikeazo
    Aug 25, 2016 at 14:51
  • $\begingroup$ I do like StackExchange and people helping out each other here vvery very much:] still reading one of the papers you've handed. ty $\endgroup$
    – Vega4
    Aug 25, 2016 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.