Consider the CPA security game which consists of the following steps:

  1. Initialization
  2. Setup
  3. Phase 1
  4. Challenge
  5. Phase 2
  6. Guess

Can someone provide the proof for this game under Bethencourt CP-ABE considering the following:

Suppose an adversary $\mathcal{A}$ has non-negligible advantage $\epsilon = Adv_{\mathcal{A}}$. Using a simulator $\mathcal{B}$ that can distinguish a DBDH tuple from a random tuple with advantage $\frac{\epsilon}{2}$. Let $e:\mathbb{G}_0 \times \mathbb{G}_0 \rightarrow \mathbb{G}_T$ be an efficiently computable bilinear map where $\mathbb{G}_0$ has a prime order $p$ with generator $g$.

The DBDH challenger selects:

$a,b,c \in \mathbb{Z}_P$

$\mu \in \{0,1 \}$

$g \in \mathbb{G}_0$

Random element $R \in \mathbb{G}_T$

The challenger defines $T=e(g,g)^{abc}$ if $\mu=0$ otherwise $T=R$. The simulator $\mathcal{B}$ is then given <$g,A,B,C,T$>=<$g,g^a,g^b,g^c,T$>. The simulator here acts as the challenger.

I have looked for this proof in many papers but can't seem to find it for the traditional Bethencourt CP-ABE.

  • $\begingroup$ What would be your motivation for having a security proof for the Bethencourt ABE reduced to DBDH? There are both more efficient and as expressive schemes (Herranz et al. in PKC 2010) and more secure schemes in terms of the underlying assumption (CP-ABE for standard model in eprint 2008/290) and especially moving from the initial selective set security to full security. $\endgroup$ – Mikko_K_123 Jan 8 '17 at 20:13
  • $\begingroup$ Usually, scheme specifics are intimately tied to the security model and proof. Thus changing the underlying assumption in some existing scheme is at least challenging, and unlikely, if the same or better expressiveness / efficiency /security can be achieved with a different construction. $\endgroup$ – Mikko_K_123 Jan 8 '17 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.