3
$\begingroup$

This is more of a good to know question, but looking online and in this forum I couldn't find an answer to this question. Was there some major reason why CP-ABE was created when KP-ABE already exist? I am new to this field so I apologise before hand if I offend anyone with this question.

$\endgroup$
1
$\begingroup$

I think you may find the founding paper of CP-ABE pretty informative on that regard: in "Ciphertext-Policy Attribute-Based Encryption" by Bethencourt et al. you can read the following:

In key-policy attribute based encryption, ciphertexts are associated with sets of descriptive attributes, and users’ keys are associated with policies (the reverse of our situation). We stress that in key policy ABE, the encryptor exerts no control over who has access to the data she encrypts, except by her choice of descriptive attributes for the data. Rather, she must trust that the key-issuer issues the appropriate keys to grant or deny access to the appropriate users. [... ] In our setting, the encryptor must be able to intelligently decide who should or should not have access to the data that she encrypts.

It's basically two different methods to achieve the same kind of goal, ie "Attribute Base Encrpytion".

You may further find this answer pretty useful and that question may also help you.

$\endgroup$
  • $\begingroup$ The paper did state that but it kinda applies to both CP abe and KP abe since KP Abe declares people whose policy satisfy my attributes can decrypt the message. While CP abe declares people whose attributes satisfy my encryption policy can decrypt the message. At the end of the day trust has to be put onto the key generator/issuer.. But your "this answer" and "that answer" made clearer on why the move was needed and I thank you for sharing those links :) Have a great day good sir! $\endgroup$ – INeedInsecticideToKillBugs Nov 22 '16 at 6:59
1
$\begingroup$

In KP-ABE, users' secret keys are generated based on an access tree that defines the privileges scope of the concerned user, and data are encrypted over a set of attribute. However, CP-ABE uses access trees to encrypt data and users' secret keys are generated over a set of attribute.

$\endgroup$
  • $\begingroup$ OK, so this is the main difference between KP-ABE and CP-ABE. Can you use this information to create an argument for why KP-ABE was not enough so that CP-ABE needed to be created? $\endgroup$ – Artjom B. Jan 9 '17 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.