I have a basic understanding of public-private and symmetric crypto, but I keep struggling with the concept of ABE. I know the difference between the two variants: Key-Policy: A key is linked to a specific access policy. A cipher text is linked to certain attributes. Ciphertext-Policy: A cipher text is linked to a specific access policy. A key is linked to a certain attribute.
But I have difficulties figuring out how this would work in practice. For example;
User 1 has attributes:
User 2 has attributes:
I would encrypt something with the policy
IsOver18 OR IsAlien in CP-ABE mode, how would this result in a decrypt able cipher text for User 2? Is this in fact encrypted twice with the two different attributes (thus keys)?
And if I would encrypt something with the policy
IsOver18 OR IsAlien in KP-ABE mode, does this mean this would be only encrypted once, but User 2 should have received the key for the access control policy
IsOver18 OR IsAlien and
IsOver18 for example? What does it mean that the cipher text is linked to attributes with this access control policy? Also; does this mean that access control policies need to be pre-defined in the system, because how could User 2 otherwise decrypt such cipher text?
I'm trying to figure out what method is best for broadcast encryption, but my lack of understanding how this works in practice makes it hard for me to figure out what's the best method.